Security Incident – So What?

Every week there is another cyberattack, another data breach, another ransomware incident in the headlines. The affected organisations promise “full transparency” and “enhanced security measures”, and two weeks later nobody talks about it anymore. But what actually happens after a security incident, beyond the press releases? And is it true that most companies just carry on as if nothing happened?

The answer is more complicated than you would think, because it varies dramatically depending on the industry, the country, and the severity of the incident.

The first weeks

Immediately after an incident the focus is on damage control and recovery, and the costs are substantial. The IBM Cost of Data Breach Report 2026 puts the average total cost of a data breach at 4.99 million dollars globally (a new record, up 12 percent from the prior year), with the US reaching 11.5 million, roughly double the global average. Healthcare averages 6.64 million, financial services 6.29 million, and the public sector gets away with 2.86 million (though that is partly because government agencies account for certain costs differently).

What often gets lost in these numbers: 63 percent of total costs fall on detection and business disruption, not on the actual remediation. On average it takes 183 days before a breach is even noticed and another 64 days to contain it, so nearly 8 months from intrusion to cleanup.

In healthcare the operational damage is particularly severe: ransomware attacks cause an average of 24 days of downtime for hospitals, patient volume drops 17 to 24 percent in the first week, and the cost of the outage runs at roughly 1.9 million dollars per day. The Change Healthcare incident in the US (February 2024) showed what happens in the worst case: the company processes half of all medical claims in the US for 900000 physicians, 33000 pharmacies and 5500 hospitals; 74 percent of hospitals reported direct impact on patient care, and total costs reached 2.5 billion dollars. UnitedHealth CEO Andrew Witty confirmed before the US Congress that the company paid 22 million dollars in ransom to the ALPHV/BlackCat group (“one of the hardest decisions of my life”), but they did not get the data back and ultimately had to notify 192.7 million affected individuals.

In Switzerland the dimensions are smaller but the patterns identical: when the practice group Vidymed was attacked in December 2023, around 100 doctors could not access patient records and had to work on paper for days. In Neuchâtel over 20000 patient files ended up on the dark web in 2022. Wetzikon Hospital (GZO) was hit by Emotet in October 2019: an IT employee noticed irregularities at the firewall, the trojan had entered via a spoofed email, medical devices had to be taken offline temporarily, doctors lost access to patient records, and the cleanup dragged on for weeks. Cost: roughly 300000 francs for incident response and new security measures. No patient data was encrypted or stolen, but the hospital itself described the outcome as “enormous luck”.

Medium term: fines, lawsuits, customer loss

After the acute phase comes the phase that for many organisations is more painful than the incident itself, because it lasts longer and is harder to control.

Regulatory consequences vary enormously by jurisdiction: in the EU, GDPR fines can run into the millions (Equifax paid between 575 and 700 million dollars in settlements and penalties total), while in Switzerland the revDSG provides for criminal fines of up to 250000 francs against responsible individuals, not against companies. If the responsible person can not be identified, the company is liable for up to 50000 francs. The FDPIC recorded a 53 percent rise in mediation requests in 2024/25 compared to the prior year, which at least suggests that affected parties are becoming more active.

In the financial sector FINMA is significantly stricter: cyberattack reports rose 30 percent in 2024, and in almost half of cases the actual target was an outsourcing partner (which shows how far the attack surface extends through outsourcing when 9 out of 10 banks outsource critical functions).

When it comes to customer churn, theory and practice diverge considerably: surveys say 7 in 10 consumers would stop shopping with a brand after a security incident, and Ponemon puts the actual customer loss at roughly one third. But reality is more nuanced. In Swiss healthcare for example there is practically no “customer loss” after a cyberattack, because patients can not simply switch their regional hospital: if you live in Wetzikon you go to the GZO regardless of whether Emotet was raging there last week, and in emergency care you have no choice at all. The same applies to government agencies and municipalities: residents of Rolle could hardly move to a different commune after the Vice Society attack. Classic customer churn mainly hits retail and e-commerce, and even there companies with quasi-monopolistic market positions (Equifax, Change Healthcare) have the advantage that their customers simply have no real alternative..

On the stock market a similar pattern emerges: Equifax lost 35 percent of its share price in the week after the incident (5 billion dollars in market cap) but fully recovered within two years and achieved record revenue of over 5 billion in 2022. Capital One initially lost 14 percent, but long term revenue remained practically unchanged. According to Ponemon, 54 percent of companies believe reputation recovery takes 10 months to over 2 years.

Who survives and who does not

The often-cited statistic that “60 percent of small businesses close within 6 months of a cyberattack” is by the way incorrect. The National Cybersecurity Alliance has officially retracted this figure because they could not verify its source. The actual bankruptcy rate according to the Verizon Data Breach Investigations Report 2025 is around 19 percent, which still means that nearly one in five affected SMBs does not survive the attack.

The list of companies that had to shut down after cyber incidents is nonetheless impressive, and there is a prominent Swiss example: the platform meineimpfungen.ch was taken offline in May 2021 due to severe security vulnerabilities (unauthorised individuals could register as healthcare professionals and view and manipulate vaccination data of roughly 450000 users), the foundation behind it went bankrupt in November 2021, and the FDPIC ultimately ordered the deletion of all data. The bankruptcy office briefly even tried to sell the vaccination data for 15000 francs to a private company, which the data protection commissioner prevented at the last moment. Internationally the picture is similar: Stoli Group USA filed for bankruptcy in August 2024 after a ransomware attack crippled its ERP systems for months, TravelEx closed in 2020 after a New Years Eve 2019 ransomware attack (over 1300 employees lost their jobs), and the American Medical Collection Agency, responsible for billing 25 million US patients, was insolvent within months of the incident.

On the other side stand companies that not only survived massive incidents but simply carried on. In Switzerland Comparis is the best known example: the comparison platform paid a ransom in 2021 (reportedly around 370000 francs), the website was back online within days, and despite confirmed access to customer data at its subsidiary Credaris the company has not lost any measurable market share. Winbiz, a Geneva based accounting software provider, went down for weeks after an attack on its hosting provider Infopro (8700 companies affected), switched hosting providers and operates normally today. And internationally: Equifax achieved 7 consecutive quarters of double digit revenue growth after its breach and hit record revenue of over 5 billion dollars in 2022. According to studies, 63 percent of all affected companies are operationally functional again within a month.

The difference between survival and failure often depends less on the scale of the incident than on financial resilience and whether the company has a product its customers actually need: a large corporation can absorb 2.5 billion dollars in damages; an SMB with 50 employees can not, and a platform whose only asset was the data is simply worthless after losing that data.

Switzerland: government and healthcare

In Switzerland the BACS (formerly NCSC) reported over 70000 incidents for 2025, an increase of 30 percent over the prior year (2024 saw roughly 63000). Ransomware remains the most financially damaging, followed by CEO fraud and supply chain attacks.

The two most prominent Swiss cases in recent years are Xplain and Concevis, both IT service providers for the federal government. In the Xplain hack of May 2023 by the group Play, 65000 files were published including data from the Army, customs and the federal police (Fedpol). The FDPIC investigation (completed April 2024) found errors on both sides, both the federal government and Xplain, particularly missing contractual restrictions on data storage. The Federal Council subsequently ordered stricter security requirements for external IT contractors, but the VBS (defense department) still needs to “urgently catch up” according to the March 2025 report.

What stands out about these cases is that the concrete consequences for the affected organisations remain limited. Xplain was acquired by the German Chapters Group in October 2024 (so not shut down), the federal government continues working with external IT providers, and the mandated improvements are decided on paper but implementation drags on.

The municipality of Rolle in Canton Vaud is a particularly instructive example: after an attack by Vice Society in May 2021 the municipality initially described the incident as a “weak attack” affecting only email. In reality, names, addresses, birthdates, social security numbers, tax records, employee evaluations and student records were all published on the dark web. The municipality later had to admit it had “underestimated the severity” of the incident.

In healthcare Switzerland is particularly exposed because many hospitals and practices operate on outdated IT infrastructure and digitisation (electronic patient records etc) is being pushed faster than the security to protect it. In June 2026 the Radix health foundation was hit, with the Sarcoma ransomware group stealing 1.3 terabytes including federal government data.

Comparison with Germany

In Germany the situation according to the BSI Lagebericht 2025 remains “very tense”: 119 new vulnerabilities per day (24 percent more than the prior year). In healthcare there were 138 security relevant incidents between October 2024 and September 2025, with healthcare providers forming the second largest category at 43 incidents.

The most well known case is the Düsseldorf University Hospital (September 2020): after a DoppelPaymer ransomware attack via a Citrix vulnerability, 30 servers were encrypted, the hospital had to de-register from emergency care, and a 78 year old patient died after being diverted 32 kilometres to another hospital. Prosecutors launched a negligent homicide investigation (later dropped because the causal connection could not be proven beyond doubt). The attackers had actually been targeting Heinrich Heine University; when they learned they had hit a hospital, they withdrew the extortion and provided the decryption key.

What is interesting though is that ransomware attacks on major German hospitals have declined significantly: from 35 (2021/22) to 21 (2023) to just 3 in 2024, likely attributable to tightened regulations (KRITIS ordinance, NIS2). Switzerland has not yet fully implemented comparable regulations.

Breach fatigue: does anyone still care?

And then there is the question of whether security incidents even cause reputational damage anymore when they have become so commonplace. The numbers point to a growing problem: 80 percent of US consumers received at least one data breach notification within 12 months, 40 percent received three to five. Nearly half (46 percent) took no action after being notified because they felt there was nothing they could do about it anyway.

The share of consumers who say that data breaches affect their trust in companies has dropped from 62 percent (2023) to 58 percent (2024); a creeping loss of trust in the loss of trust, so to speak. Carlos Morales of Vercara put it well: “The biggest surprise is the starting of apathy… people are maybe just accepting it as a new reality.”

At the same time there is a gap between what consumers say and what they do: 7 in 10 say they would stop shopping with a breached company, but the actual revenue numbers of affected companis often tell a different story. Serious incidents involving credit card or health data do remain in public memory for over 10 months (70 percent still remembered the Target breach after 10 months), while “ordinary” data leaks are quickly forgotten…

Generational differences also play a role: baby boomers are most likely to change their behaviour after an incident while Gen Z is least concerned (which is perhaps because they grew up with permanent data breaches and simply do not know anything else).

What remains

The data paints a nuanced picture: a security incident is not an existential threat for most organisations, but neither is it the triviality it is often treated as. Roughly 19 percent of SMBs do not survive the attack, large enterprises almost always recover financially, and the public sector suffers least from direct costs but most from the (slow) erosion of trust.

The real scandal is not the individual incident but the systematic repetition of the same mistakes: missing segmentation, weak passwords, unprotected endpoints, inadequate patch management and service providers who hoard production data on their own systems without contractual clarity on what they are allowed to do with it. The Xplain investigation documented this clearly for Switzerland, and yet two years later the VBS is still being told to “urgently catch up”.

Whether that is enough to prevent the next headline…

If you want to know where your organisation actually stands and whether the basics are truly in place: get in touch for a no-obligation security assessment.

Sources:

Autor: Andriu Isenring CISSP