Swiss firm Ruag paid ransom to hackers despite official warnings

Swiss authorities maintain a firm stance: never pay ransoms to cybercriminals. This message, repeated for years, aims to starve organized cybercrime of funds. Companies and public entities hit by ransomware attacks, which steal data and paralyze systems, are repeatedly told not to yield to hackers' demands.

However, the reality on the ground often diverges sharply from official directives. The recent case of Ruag, a federal armaments company, exemplifies this. Ruag paid a ransom to the Akira hacker group following a cyberattack on its U.S. subsidiary, Ruag LLC. The hackers had stolen data and threatened to publish it on the dark web unless a payment was made.

Against the explicit recommendations of the Federal Office for Cybersecurity, Ruag succumbed to the pressure. "We paid a small amount and fortunately recovered all the data," stated Jürg Rötheli, chairman of the board, to Swiss media. This incident underscores the difficult choices companies face when their data is compromised and the potential conflict between national cybersecurity policy and immediate corporate damage control.

“

We paid a small amount and we have fortunately recovered all the data.