Sarcoma ransomware attack on Radix leaks 1.3TB of Swiss government data, exposing supply chain risks and sparking urgent cybersecurity response.
Continue reading
A sophisticated ransomware attack has rocked Switzerland’s federal administration, exposing the nation’s persistent vulnerabilities to supply chain cyber threats. On June 16, 2025, the non-profit health foundation Radix, a trusted contractor for numerous Swiss federal offices, fell victim to the Sarcoma ransomware group.
The fallout: 1.3 terabytes of sensitive data—ranging from official documents to private correspondence—now circulating on the dark web, and a government facing urgent questions about third-party risk management.
Sarcoma, first detected in late 2024, has rapidly evolved into a formidable cybercrime collective, specializing in double extortion attacks. Unlike traditional ransomware, Sarcoma’s operations blend data encryption with large-scale data theft, leveraging the threat of public leaks to pressure victims. The group’s tactics are highly targeted, relying on spear-phishing, exploitation of unpatched software, and lateral movement through remote access tools and credential theft.
Radix, based in Zurich, manages health and administrative projects for federal, cantonal, and municipal authorities. On June 16, Sarcoma infiltrated Radix’s systems, exfiltrated a massive trove of data, and encrypted internal files.
When Radix refused to pay the ransom, Sarcoma published the stolen data—spanning financial records, contracts, and sensitive communications—on its dark web leak portal on June 29.
Although Radix operates independently and holds no direct access to government IT systems, the breach’s impact is significant. As a contractor serving various federal offices, Radix stored and processed government data, now confirmed by Swiss authorities to have been leaked. The National Cyber Security Centre (NCSC) is leading the analysis to determine which agencies and datasets are affected, but the sheer volume—1.3TB—underscores the magnitude of the exposure.
The leaked archives reportedly include:
While Radix has notified affected individuals and maintains that there is no evidence of partner organization data being compromised, the investigation is ongoing, and the risk of phishing, fraud, and identity theft remains high.
This breach follows a troubling pattern in Switzerland. In 2024, a ransomware attack on Xplain, another government IT contractor, led to the leak of over 65,000 sensitive documents, including classified files and login credentials for federal agencies. These incidents highlight how attackers increasingly target third-party suppliers to circumvent direct government defenses.
Sarcoma’s modus operandi—double extortion—mirrors a broader shift in ransomware strategy. By exfiltrating data before encryption, attackers gain leverage: even if victims refuse to pay, the threat of public exposure persists.
In Radix’s case, the refusal to pay led directly to the publication of the data, amplifying the breach’s consequences and complicating the incident response.
The NCSC, in coordination with Radix, law enforcement, and affected federal units, is conducting a comprehensive review to map the full extent of the breach. Authorities have urged vigilance, warning of increased phishing attempts leveraging leaked data. Radix has pledged transparency and is working to inform all individuals who may be potentially impacted.
This incident underscores the critical importance of robust third-party risk management in government IT. As cybercriminals increasingly exploit supply chain weaknesses, Swiss authorities—and governments worldwide—face mounting pressure to enforce stricter security standards, conduct regular audits, and ensure rapid incident detection and response across all contractors and partners.
148 malicious npm packages masquerading as student proxy and school Wi-Fi bypass tools. Rather than compromising developers during installation
