The Swiss government has warned that sensitive data has been stolen and leaked following a cyber attack on a supplier.
Radix, a non-profit organization in the health promotion sector, supplies a number of federal offices, whose data has apparently been accessed.
"Investigations are currently under way to determine the specific units and data affected by the attack," Swiss authorities said in a statement. "As Radix has no direct access to Federal Administration systems, the attackers did not gain entry to these systems at any time."
The government said that the Swiss National Cyber Security Center (NCSC) is coordinating further investigations.
The agency is in continuous dialogue with Radix, as well as the prosecution authorities and the Federal Administration units affected by the attack, and will release more information in due course.
With the government apparently refusing to pay a ransom, the stolen data has now been published on the dark web by the Sarcoma ransomware group.
"Affected individuals were personally informed if particularly sensitive personal data could have been affected," said Radix.
"Based on current knowledge, there is no indication that sensitive data from partner organizations has been affected."
Who are the Sarcoma ransomware group?
The Sarcoma ransomware group has appeared relatively recently, having been first detected late last year.
Since then, though, it's become highly active, targeting organizations including Smart Media Group Bulgaria, Unimicron, and TMA Group.
The group typically carries out its attacks via phishing emails, but is known to also target outdated software and vulnerabilities, as well as supply chain weaknesses.
Andrew Costis, engineering manager of the adversary research team at AttackIQ, said that while the group is a relative newcomer to the cyber crime landscape, it’s been “very active” and claimed 36 attacks in its first month.
"Sarcoma is known for implementing double extortion tactics, where members are pressured into paying ransoms to avoid information being leaked."
Governments are increasingly coming under fire from cyber attackers, and while this is mostly due to the activity of hostile nation states, there's a threat from financially motivated ransomware gangs as well.
“This incident is yet another reminder that public sector institutions and non-profits are not immune to the tactics of increasingly professionalised cybercriminal groups,” said Lee Driver, vice president of managed security services at Ekco.
“Even when the attack isn’t directly on government infrastructure, the ripple effect through shared third-party platforms can expose sensitive data and create serious trust issues.”
"With data already appearing on the dark web, we’re likely to see further implications as investigators identify which departments and datasets were affected."
According to the Swiss NCSC, it received a cyber incident report on average every 8.5 minutes last year. Over the first half of 2024, the number was almost twice that for the same period the previous year.
MORE FROM ITPRO
- Ransomware victims are getting better at haggling with hackers
- Building ransomware resilience to avoid paying out
- The new ransomware groups worrying security researchers in 2025
-
Using DeepSeek at work is like ‘printing out and handing over your confidential information’News Thinking of using DeepSeek at work? Think again. Cybersecurity experts have warned you're putting your enterprise at huge risk.
-
Can cyber group takedowns last?ITPro Podcast Threat groups can recover from website takeovers or rebrand for new activity – but each successful sting provides researchers with valuable data
-
Average ransom payment doubles in a single quarterNews Targeted social engineering and data exfiltration have become the biggest tactics as three major ransomware groups dominate
-
BlackSuit ransomware gang taken down in latest law enforcement sting – but members have already formed a new groupNews The notorious gang has seen its servers taken down and bitcoin seized, but may have morphed into a new group called Chaos
-
Google cyber researchers were tracking the ShinyHunters group’s Salesforce attacks – then realized they’d also fallen victimNews In an update to an investigation on the ShinyHunters group, Google revealed it had also been affected
-
Nearly one-third of ransomware victims are hit multiple times, even after paying hackersNews Many ransomware victims are being hit more than once, largely thanks to fragmented security tactics
-
75% of UK business leaders are willing to risk criminal penalties to pay ransomsNews A ransom payment ban is a great idea - until you're the one being targeted...
-
The Scattered Spider ransomware group is infiltrating Slack and Microsoft Teams to target vulnerable employeesNews The group is using new ransomware variants and new social engineering techniques - including sneaking into corporate teleconferences
-
Hackers breached a 158 year old company by guessing an employee password – experts say it’s a ‘pertinent reminder’ of the devastating impact of cyber crimeNews A Panorama documentary exposed hackers' techniques and talked to the teams trying to tackle them
-
The ransomware boom shows no signs of letting up – and these groups are causing the most chaos
News Thousands of ransomware cases have already been posted on the dark web this year
