What happened?
In early February 2026, TRISA AG, headquartered in Triengen (Canton Lucerne), fell victim to a targeted ransomware attack by the hacker group Lynx. The attackers penetrated the company’s IT infrastructure, encrypted critical systems and exfiltrated approximately 1 terabyte of corporate data.
Lynx is a comparatively young but extremely active ransomware group that has been targeting industrial companies since 2024, employing a double extortion strategy: besides encrypting systems, the attackers threaten to publish stolen data on their darknet leak site.
Initial access was presumably gained through a vulnerability in an exposed service or compromised credentials. The attackers then moved laterally through the network, escalated privileges and systematically prepared the exfiltration and encryption — suggesting a multi-week presence in the network.
Who was affected?
TRISA AG is a traditional Swiss family-owned company with over 135 years of history, approximately 1,100 employees and annual revenues of about CHF 215 million.
- Production systems: Manufacturing at the Triengen headquarters was temporarily impaired
- Employees: Personal data of approximately 1,100 staff were potentially in the exfiltrated data
- Business partners and customers: Confidential business information, price lists and contract details may have been compromised
- Research and development: Patents, product developments and manufacturing processes of high value
How large was the damage?
| Damage category | Estimated cost |
|---|---|
| Production downtime and business interruption | CHF 2–5m |
| Incident response and forensics | CHF 500,000–1m |
| System restoration and IT rebuild | CHF 1–3m |
| Legal advice and data protection | CHF 200,000–500,000 |
| Crisis communication and PR | CHF 100,000–300,000 |
| Estimated total damage | CHF 5–13m |
A cyber insurance policy with CHF 5–10m coverage would have covered 50–70% of direct damages.
Lessons for Swiss SMEs
- Manufacturing companies are high-value targets due to OT/IT convergence.
- 1 TB of exfiltration often goes undetected: monitoring solutions are essential.
- Double extortion is the new standard.
- Protect intellectual property in separate network segments.
- Cyber insurance as a financial safety net.
- Comply with the reporting obligation to the BACS within 24 hours.
Get a free consultation. The experts at BTAG Versicherungsbroker AG in Bern find the right cyber insurance for your manufacturing company.