In short: The French-speaking Swiss radiology network Groupe 3R (Réseau Radiologique Romand) was hit by a ransomware attack with data encryption on Thursday, 30 April 2026. Administrative data, including personal data of current and former employees, was encrypted and stolen; according to Groupe 3R, it cannot say with certainty whether medical patient data was also exfiltrated. The group is not paying a ransom and has been running a completely rebuilt IT infrastructure since 26 June 2026.
Key facts
- Attack: 30 April 2026, ransomware with data encryption
- Operations: the centres stayed open; the impact was felt mainly on 1 and 2 May 2026, and some examinations were postponed or moved
- Data: medical reports were encrypted and unusable; administrative data, including employees’ personal data, was stolen
- Ransom: no payment, in line with the authorities’ recommendations
- Reporting: incident reported to the National Cyber Security Centre (NCSC), criminal complaint filed
- Rebuild: since 26 June 2026, a new, secured IT infrastructure in all centres; RIS, PACS, telephony and teleradiology back in operation
- Source: Groupe 3R information page, as of 22 September 2026
What happened?
Groupe 3R runs radiology centres in several cantons of French-speaking Switzerland as well as in Bern and Zurich. According to the group, it was a ransomware attack with data encryption. The centres remained open but had to postpone some examinations or move them to other sites.
The group confirms that administrative data was encrypted and stolen, including personal information about current and former employees. It cannot say with certainty whether patients’ medical data was also stolen; investigations are ongoing. On 17 June 2026, Groupe 3R responded to an RTS report from the previous day that had used stolen information.
The group had already been hit by a cyber attack in 2025. According to Groupe 3R, the 2026 attack is unrelated: different perpetrators, different methods. According to the information page, access to part of the older examination data had not yet been fully restored.
What this means for Swiss SMEs
The case shows that ransomware now almost always hits twice: systems go down and data is copied. Personnel data is a lucrative target too.
- Test offline backups and recovery: Groupe 3R needed around eight weeks to get its new infrastructure running. Plan realistically which processes you can continue manually, and for how long.
- Protect personnel and HR data: restrict access, minimise data and store it encrypted.
- No ransom without careful review: the authorities advise against paying. More in the guide Ransomware and cyber insurance.
- Clarify reporting: check whether you need to report to the NCSC or the FDPIC. Overview under Reporting obligations for cyber attacks.
- Inform those affected: warn employees early and specifically, for example about targeted phishing using the stolen data.