Ransomware (extortion): Company, Switzerland 2025
Between May 2023 and September 2025, the Akira group attacked around 200 companies in Switzerland with ransomware, most recently four to five cases a week.
- Incident · 10.2025 · Switzerland
- Evidence: confirmed by an authority
- Ransomware (extortion)
- Data breach
As of
What happened
It first steals data and then encrypts (double extortion). The Office of the Attorney General has been conducting criminal proceedings since April 2024; the loss in Switzerland amounts to several million francs.
- Affected
- Company (anonymous)
- Industry
- several industries
- Loss
- several million francs (all Swiss cases together)
- Business interruption
- unknown
- Ransom demanded / paid
- yes / unknown
- Data affected
- unknown
- Bankruptcy
- no
- Entry point
- not stated in the sources
What would cyber insurance have paid?
That depends on the terms. Whether those affected were insured: unknown.
-
Costs of getting data, software and systems running again
Mostly covered 6 of 9 business products cover it fully, as an add-on or with limits.
-
Loss of income after an attack
Business interruption, only after the waiting period
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
-
Help and negotiation; only some insurers pay the ransom, see note
Mostly add-on 6 of 9 business products cover it fully, as an add-on or with limits.
-
Immediate help in an emergency
Hotline, IT forensics, crisis PR and legal advice
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
-
Letters, call centre, credit monitoring
Mostly covered 6 of 9 business products cover it fully, as an add-on or with limits.
Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.
What we can learn
The authorities advise contacting them before taking any action and filing a criminal complaint.
Sources
- Cyberkriminalität: Hackergruppe AKIRA intensiviert ihre Aktivitäten (opens in a new window) Bundesamt für Cybersicherheit BACS / Bundesanwaltschaft / fedpol · 16.10.2025
«Ungefähr 200 Unternehmen in der Schweiz wurden bereits Opfer dieser Angriffe.»