In short: On 16 October 2025, the Office of the Attorney General of Switzerland (OAG), the Federal Office of Police (fedpol) and the National Cyber Security Centre (NCSC) jointly warned about the ransomware group Akira. According to the authorities, around 200 companies in Switzerland have fallen victim, with damages in Switzerland amounting to several million francs. With four to five cases per week, the authorities describe this as a record for Switzerland.
Key facts at a glance
- Date: joint statement of 16 October 2025; the attacks covered by the criminal proceedings took place between May 2023 and September 2025 (source: NCSC statement).
- Victims: around 200 companies in Switzerland; the authorities do not name them (source: NCSC statement).
- Attack type: ransomware with double extortion: data is first stolen, then encrypted (source: NCSC statement).
- Damage: several million francs in Switzerland, several hundred million dollars worldwide (source: NCSC statement).
- Frequency: four to five cases per week, a record for Switzerland (source: NCSC statement).
- Criminal proceedings: the OAG has been investigating persons unknown since April 2024 (source: NCSC statement).
What is confirmed?
According to the authorities, Akira first appeared in March 2023. The group uses purpose-built software and an IT infrastructure spread across several countries. It practises so-called double extortion: it first steals data and then encrypts it. If the ransom is not paid on time, it publishes the data on its darknet site (data leak site). Payments are usually made in Bitcoin.
Since April 2024, the OAG has been conducting criminal proceedings against persons unknown for unauthorised obtaining of data (Art. 143 Swiss Criminal Code), damage to data (Art. 144bis SCC) and extortion, alternatively attempted extortion (Art. 156 SCC, Art. 22 in conjunction with Art. 156 SCC). It has taken over several cantonal proceedings into similar attacks. fedpol coordinates the investigation with the NCSC and with authorities in other affected countries.
The authorities assume a high number of unreported cases, because victims pay the ransom or refrain from filing a criminal complaint out of concern for their reputation. According to the statement, many attacks can be prevented by updating outdated systems and protecting remote access such as VPN and RDP with two-factor authentication.
What is not known?
- Who is affected: the authorities name no companies and give no breakdown by industry or company size. How many of the around 200 victims are SMEs has not been published.
- Damage per case: there are no official figures on damage, ransom demands or downtime for individual companies.
- Payments: how many victims paid a ransom is not known.
- Insurance: whether and how cyber insurers paid out in these cases is not documented.
- Current status: this case study is based on the statement of 16 October 2025. Later developments in the criminal proceedings are not reflected here.
What it means for cyber insurance
No coverage commitment can be derived from this wave of attacks. Depending on the policy, relevant modules may include incident response and IT forensics, legal and data protection advice, data restoration, business interruption, costs of notifying affected persons or crisis communication. Whether and to what extent benefits apply depends in particular on the policy wording, sub-limits and exclusions, the agreed security obligations and the specific claims process.
The authorities expressly advise against paying ransoms. How a policy deals with extortion cases must be checked in its wording. In addition, security requirements such as two-factor authentication for remote access or regular updates may form part of the contractual obligations.
Lessons for Swiss SMEs
- Secure remote access: operate VPN and RDP access only with two-factor authentication and close access points you do not need.
- Keep systems up to date: install updates for firewalls, VPN appliances, servers and clients promptly; replace or isolate outdated systems.
- Test your backups: restore backups regularly and keep at least one copy separate from the network.
- Define immediate measures: record in your emergency plan who disconnects all internet connections (web, email, remote access, site-to-site VPN), secures the backups and physically takes infected systems off the network.
- Contact the authorities: contact the authorities before responding to any ransom demand and file a criminal complaint in every case.
- Plan for data theft: with double extortion, a backup does not prevent stolen data from being published. Know where your customer and personal data is stored.
- Review your policy: check which modules your cyber insurance includes, which obligations apply and whom you call first in a claim.