Ransomware (extortion): Hospital and care home, Switzerland 2026
On 30 April 2026, a ransomware attack, which the group itself attributes to Akira, hit the network of 20 radiology centres in French-speaking Switzerland.
- Incident · 04.2026 · French-speaking Switzerland (20 centres in seven cantons), Switzerland
- Evidence: confirmed by an authority
- Ransomware (extortion)
- Data breach
As of
What happened
Medical data was encrypted, company data stolen and internal documents published on the darknet; some examinations had to be postponed, while the centres remained open. It was the second attack after a data theft in April 2025; the group built up a new, secured IT system.
- Affected
- Réseau Radiologique Romand (Groupe 3R)
- Industry
- Hospital and care home
- Loss
- no reliable figure
- Business interruption
- unknown
- Ransom demanded / paid
- unknown / unknown
- Data affected
- medical data encrypted; company data stolen, internal documents published on the darknet
- Bankruptcy
- no
- Entry point
- not stated in the sources
What would cyber insurance have paid?
That depends on the terms. Whether those affected were insured: unknown.
-
Help and negotiation; only some insurers pay the ransom, see note
Mostly add-on 6 of 9 business products cover it fully, as an add-on or with limits.
-
Loss of income after an attack
Business interruption, only after the waiting period
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
-
Costs of getting data, software and systems running again
Mostly covered 6 of 9 business products cover it fully, as an add-on or with limits.
-
Immediate help in an emergency
Hotline, IT forensics, crisis PR and legal advice
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
-
Letters, call centre, credit monitoring
Mostly covered 6 of 9 business products cover it fully, as an add-on or with limits.
Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.
What we can learn
A planned IT overhaul only protects once it has been implemented; after a first attack, every week counts.
Sources
- Cyberangriff legt Westschweizer Radiologie-Netzwerk erneut lahm (opens in a new window) Netzwoche · 07.05.2026, mit Updates
«Eine solche Transformation lässt sich jedoch nicht kurzfristig umsetzen.»