BERN - The Swiss state has an extortion problem, and this one carries names. The Akira ransomware group claims to have stolen the data of federal employees across the administration, a haul that reportedly includes records touching former Federal Councillors, members of the intelligence services and soldiers from elite units. The criminals are demanding a ransom to keep the material off the dark web.
The claim lands with particular weight because Akira is not an unknown quantity. The Federal Office of Police had warned Swiss organisations about the group's methods earlier this year, describing a crew that breaks in quietly, copies what it can, and only then begins the blackmail. That warning now reads like a preview.
A familiar playbook
Akira operates the way modern ransomware gangs do: steal first, encrypt second, negotiate third. The leverage is rarely the locked computer; it is the threat of publication. When the stolen data concerns people whose security depends on anonymity, the pressure multiplies. Records of intelligence staff and special forces soldiers are not the kind of material any government wants to see traded.
Federal authorities have not publicly detailed the scope of the theft or the sum demanded. What is clear is that the state has been here before, repeatedly, and recently. The federal pension fund Publica disclosed a breach at a supplier earlier this month, and the Zurich city pension fund is still warning its members after hackers got into its software provider. The state-owned aerospace firm Beyond Gravity spent months quietly working with forensics specialists after a targeted intrusion it disclosed in early October.
To pay or not to pay
The official position of most European governments, Switzerland included, is that ransoms should not be paid. Payment funds the next attack and guarantees nothing about the data. But that doctrine is easier to state from a podium than to apply when the records at stake belong to people whose work assumes they cannot be identified.
Security specialists contacted by this newspaper on Tuesday were unanimous on one point: anyone whose data may be caught in the haul should assume targeted phishing is coming. The same advice given to pension fund members this month now applies, uncomfortably, to people at the heart of the state. The National Cyber Security Centre is expected to comment once its analysis of the leak's authenticity is complete.