Ransomware (extortion): Municipality and public administration, Switzerland 2026
In April 2026, an attack, presumably by the Akira group, hit an IT service provider of the municipality in Valais.
- Incident · 04.2026 · Vétroz VS, Switzerland
- Evidence: confirmed by an authority
- Ransomware (extortion)
- Attack via a supplier
As of
What happened
The counter, residents’ registration, building permits and specialist applications were down for several days, and even after ten days payments and invoicing were still not fully working. Thanks to backups, the systems were restored; data of around two working days was lost.
- Affected
- Municipality of Vétroz
- Loss
- no reliable figure
- Business interruption
- unknown
- Ransom demanded / paid
- unknown / unknown
- Data affected
- Data of about two working days lost; whereabouts of the data uncertain
- Bankruptcy
- no
- Entry point
- Attack on an IT service provider of the municipality
What would cyber insurance have paid?
That depends on the terms. Whether those affected were insured: unknown.
-
Loss of income if the cloud or a provider is attacked
Mostly limited 6 of 9 business products cover it fully, as an add-on or with limits.
-
Costs of getting data, software and systems running again
Mostly covered 6 of 9 business products cover it fully, as an add-on or with limits.
-
Immediate help in an emergency
Hotline, IT forensics, crisis PR and legal advice
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
-
Letters, call centre, credit monitoring
Mostly covered 6 of 9 business products cover it fully, as an add-on or with limits.
Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.
What we can learn
If the IT service provider fails, the administration comes to a halt; backups and emergency processes belong in the contract with the service provider.
Sources
- Walliser Gemeinde Vétroz erholt sich von einem Cyberangriff (opens in a new window) Netzwoche · 27.04.2026
«Zum jetzigen Zeitpunkt ist der genaue Verbleib der Daten noch ungewiss.»
Similar cases
- Ransomware (extortion): Municipality and public administration, Switzerland 2026
- Overload attack (DDoS): Municipality and public administration, Switzerland 2024
- Ransomware (extortion): Municipality and public administration, Switzerland 2023
- Ransomware (extortion): Municipality and public administration, Switzerland 2021