In short: On 6 February 2026, TRISA AG of Triengen (canton of Lucerne) announced that a ransomware attacker had briefly gained access to narrowly limited areas of its IT system. According to the company, a clearly limited part of its data was copied, while ongoing operations and its ability to deliver were maintained at all times. Speaking to the media, TRISA put the copied share at less than one percent of company data.
Key facts at a glance
- Date: TRISA AG statement of 6 February 2026 (TRISA).
- Company: TRISA AG, a maker of toothbrushes and hairbrushes based in Triengen, canton of Lucerne (TRISA).
- Attack type: Ransomware attack; according to media reports, the Lynx group claimed responsibility (blue News/SDA).
- Confirmed impact: A clearly limited part of company data was copied; operations and delivery capability were unaffected (TRISA).
- Response: Reporting obligations met promptly, criminal complaint filed, systems monitored by internal and external security experts (TRISA).
What has been confirmed?
In its statement “IT security incident contained” of 6 February 2026, TRISA AG writes that a ransomware attacker briefly managed to enter narrowly limited areas of its IT system. Thanks to measures taken immediately, ongoing operations and delivery capability were maintained without restriction at all times.
According to TRISA, a clearly limited part of company data was copied. The company says it met its reporting obligations promptly and filed a criminal complaint. All IT systems were working properly and continued to be monitored by internal and external security experts.
The Swiss news agency SDA, citing the portal Inside-IT, reported that TRISA had confirmed the incident. According to that report, less than one percent of company data was copied, possibly including customer or employee data. All affected persons had been informed.
What is not known?
- How the attackers gained access to the IT system has not been publicly documented.
- TRISA has not published which categories of data were copied or how many people are affected.
- According to SDA, the attackers claim to have stolen more than one terabyte of data and set a one-week deadline. This claim comes from the perpetrators and has not been independently confirmed.
- Whether a ransom was demanded or paid is not known.
- TRISA has given no information on the financial consequences or on any insurance.
Cyber insurance context
No coverage commitment can be derived from the incident alone. Depending on the policy, relevant modules may include incident response and IT forensics, legal and data protection advice, notification of affected persons, data recovery or crisis communication. Since TRISA says operations were not interrupted, the case also shows that after data theft without a production outage, costs for analysis, legal advice and communication tend to matter more than business interruption. Whether and to what extent a benefit applies depends on the policy wording, sub-limits and exclusions, agreed security obligations and the specific claims process.
Lessons for Swiss SMEs
- Prepare segmentation: By its own account, TRISA was able to limit the attack to narrowly limited areas. Separate office IT, production and sensitive data into distinct network zones.
- Define immediate measures: Document who may isolate systems, which external forensics partners will be called in and how delivery capability is secured.
- Clarify reporting obligations in advance: Check beforehand which notifications you must make, for example to the FDPIC under the Data Protection Act, and how you will inform affected persons.
- File a criminal complaint: Build the complaint to the cantonal police into your emergency procedure and secure evidence before clean-up.
- Treat attacker claims with caution: In the TRISA case, the attackers’ terabyte claim and the company’s figure stand side by side. Your own forensic analysis of the data actually copied is the basis for communication and notifications.
- Prepare communication: A short, fact-based statement like TRISA’s is easier to write when templates and approval paths already exist.
- Review your insurance specifically: Check which modules your policy provides for forensics, legal advice and notification, and which obligations apply.