Switzerland's National Cyber Security Center (NCSC) has analyzed a data breach resulting from a Play ransomware attack on Xplain and exposed thousands of government documents .
Xplain is a Swiss technology and software solutions provider used by various government departments, administrative units, and the country's military. The ransomware gang breached the company on May 23, 2023.
The hackers said at the time that they had stolen documents with confidential information and in early June 2023, they published the stolen data on their darknet portal.
The Swiss government began investigating the leaked files and admitted that the data may have contained documents belonging to the Swiss Federal Administration.
See also: Play ransomware: Has compromised 300 organizations
In a new statement, the Swiss government has now confirmed that 65,000 government documents were leaked due to this ransomware attack. Specifically, it states that of the approximately 1.3 million files published by the Play ransomware gang, approximately 5% (65,000 documents) relate to the Federal Administration.
Most (95%) of these files affect the administrative units of the Federal Department of Justice and Police (FDJP): the Federal Service , the Federal Police Service, the State Secretariat for Migration and the internal IT service center ISC-FDJP.
According to the government, the Federal Ministry of Defense, Civil Protection and Sports (DDPS) was also affected, but to a much lesser extent (3% of the data).
In addition, hackers leaked 5,000 documents with sensitive information, including personal data (names, email addresses , phone numbers, and addresses), technical details, passwords, and other important data .
Finally, there were some files with information about IT systems, software, architectural data and passwords.
See also: Thousands of Dutch passports stolen in ransomware attacks
Switzerland launched an administrative investigation into the Play ransomware attack and data leak on August 23, 2023, and is set to conclude it at the end of this month.
The investigation took a long time, given the large volume of data that was leaked and had to be analyzed.
The leak of 65,000 government documents significantly affects Switzerland's national security . The leak jeopardizes the protection of citizens' personal data , as many of the documents contained sensitive information.
☁️ Keep safe copies with Proton Drive
Encrypted cloud storage from Proton — protect your files from ransomware, corruption, and data loss with end-to-end encryption.
- ✔ End-to-end encrypted files & backups
- ✔ Version history — recover files after ransomware
- ✔ Free space — sync across all devices
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
The incident may also have undermined citizens' trust in the government and state authorities, as their vulnerability to cyberattacks was revealed. This may result in citizens losing confidence in the government's ability to protect data .
See also: Sweden victim of a wave of ransomware attacks
Secondly, this leak may have affected Switzerland's international relations. If the documents contained sensitive information about the country's diplomatic relations, this could have negative consequences for its relations with other countries.
Finally, this leak could have affected the Swiss economy . The government will need to invest significant resources to deal with the consequences of the leak, upgrade its security systems , and prevent future attacks.
Source: www.bleepingcomputer.com
