The Swiss government has warned that sensitive data has been stolen and leaked following a cyber attack on a supplier.
Radix, a non-profit organization in the health promotion sector, supplies a number of federal offices, whose data has apparently been accessed.
"Investigations are currently under way to determine the specific units and data affected by the attack," Swiss authorities said in a statement. "As Radix has no direct access to Federal Administration systems, the attackers did not gain entry to these systems at any time."
The government said that the Swiss National Cyber Security Center (NCSC) is coordinating further investigations.
The agency is in continuous dialogue with Radix, as well as the prosecution authorities and the Federal Administration units affected by the attack, and will release more information in due course.
With the government apparently refusing to pay a ransom, the stolen data has now been published on the dark web by the Sarcoma ransomware group.
"Affected individuals were personally informed if particularly sensitive personal data could have been affected," said Radix.
"Based on current knowledge, there is no indication that sensitive data from partner organizations has been affected."
Who are the Sarcoma ransomware group?
The Sarcoma ransomware group has appeared relatively recently, having been first detected late last year.
Since then, though, it's become highly active, targeting organizations including Smart Media Group Bulgaria, Unimicron, and TMA Group.
The group typically carries out its attacks via phishing emails, but is known to also target outdated software and vulnerabilities, as well as supply chain weaknesses.
Andrew Costis, engineering manager of the adversary research team at AttackIQ, said that while the group is a relative newcomer to the cyber crime landscape, it’s been “very active” and claimed 36 attacks in its first month.
"Sarcoma is known for implementing double extortion tactics, where members are pressured into paying ransoms to avoid information being leaked."
Governments are increasingly coming under fire from cyber attackers, and while this is mostly due to the activity of hostile nation states, there's a threat from financially motivated ransomware gangs as well.
“This incident is yet another reminder that public sector institutions and non-profits are not immune to the tactics of increasingly professionalised cybercriminal groups,” said Lee Driver, vice president of managed security services at Ekco.
“Even when the attack isn’t directly on government infrastructure, the ripple effect through shared third-party platforms can expose sensitive data and create serious trust issues.”
"With data already appearing on the dark web, we’re likely to see further implications as investigators identify which departments and datasets were affected."
According to the Swiss NCSC, it received a cyber incident report on average every 8.5 minutes last year. Over the first half of 2024, the number was almost twice that for the same period the previous year.
MORE FROM ITPRO
- Ransomware victims are getting better at haggling with hackers
- Building ransomware resilience to avoid paying out
- The new ransomware groups worrying security researchers in 2025
-
The move to a digital network and its role in the bigger picture of achieving true digital transformation: how SMBs can set themselves up for successSupported Beyond the dial tone, the digital switchover is the key to SMB success
-
Middlesbrough Council boosts cybersecurity spending, strategy in response to repeated cyberattacksReviews Councils across the UK have publicly struggled with maintaining services in the face of major cyber disruption
-
NCA confirms arrest after airport cyber disruptionNews Disruption is easing across Europe following the ransomware incident
-
Cyber professionals are losing sleep over late night attacksNews Hackers are biding their time and launching attacks when businesses can’t respond
-
Prolific ransomware operator added to Europe’s Most Wanted list as US dangles $10 million rewardNews The US Department of Justice is offering a reward of up to $10 million for information leading to the arrest of Volodymyr Viktorovych Tymoshchuk, an alleged ransomware criminal.
-
Jaguar Land Rover “did the right thing” shutting down systems to thwart cyber attackNews The attack on Jaguar Land Rover highlights the growing attractiveness of the automotive sector
-
Ransomware attack on IT supplier disrupts hundreds of Swedish municipalitiesNews The attack on IT systems supplier Miljödata has impacted public sector services across the country
-
A notorious hacker group is ramping up cloud-based ransomware attacksNews The Storm-0501 threat group is refining its tactics, according to Microsoft, shifting away from traditional endpoint-based attacks and toward cloud-based ransomware.
-
Security researchers have just identified what could be the first ‘AI-powered’ ransomware strain – and it uses OpenAI’s gpt-oss-20b modelNews Using OpenAI's gpt-oss:20b model, ‘PromptLock’ generates malicious Lua scripts via the Ollama API.
-
Data I/O shuts down systems in wake of ransomware attack
News Regulatory filings by Data I/O suggest the costs of dealing with the attack could be significant
