Ransomware (extortion): Association and foundation, Switzerland 2025
In June 2025, the non-profit foundation for health promotion fell victim to a ransomware attack: data was stolen, encrypted and then published on the darknet.
- Incident · 06.2025 · Switzerland
- Evidence: confirmed by an authority
- Ransomware (extortion)
- Data breach
- Attack via a supplier
As of
What happened
Because various federal agencies are clients of Radix, the NCSC clarified which federal data was affected. The attackers had no access to systems of the federal administration.
- Affected
- Stiftung Radix
- Industry
- Association and foundation
- Loss
- no reliable figure
- Business interruption
- unknown
- Ransom demanded / paid
- unknown / unknown
- Data affected
- stolen data published on the darknet, data of federal agencies possibly also affected
- Bankruptcy
- no
- Entry point
- not stated in the sources
What would cyber insurance have paid?
That depends on the terms. Whether those affected were insured: unknown.
-
Costs of getting data, software and systems running again
Mostly covered 6 of 9 business products cover it fully, as an add-on or with limits.
-
Help and negotiation; only some insurers pay the ransom, see note
Mostly add-on 6 of 9 business products cover it fully, as an add-on or with limits.
-
Letters, call centre, credit monitoring
Mostly covered 6 of 9 business products cover it fully, as an add-on or with limits.
-
Third-party claims after a data breach
Liability for data protection and network security breaches
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.
What we can learn
Non-profit organisations also hold data of their clients and are therefore part of their supply chain.
Sources
- Cyberangriff auf die Stiftung Radix: Auch Daten der Bundesverwaltung sind betroffen (opens in a new window) Bundesamt für Cybersicherheit BACS · 30.06.2025
«Nachdem die Daten entwendet und verschlüsselt worden waren, haben die Angreifer die entwendeten Daten ins Darknet gestellt.»