More than half of Swiss companies hit by ransomware pay the ransom: 54 percent according to Sophos’ “State of Ransomware 2025” report, which is a bit higher than the global average of 50 percent. Almost none of those payments ever become public though, and the few cases that do surface tell us more about the real calculus behind this decision than any survey could.
There is a gap between what the authorities recommend and what actually happens behind closed boardroom doors, so let’s look at who paid, who refused and what happened next, as far as we know.
Who paid
RUAG (2025). In November 2025 the Akira ransomware group breached RUAG LLC, the US subsidiary of Switzerland’s federal defence contractor, encrypting 24 GB of employee data including social security numbers, identity documents, drivers licences and home addresses. RUAG paid a “low six figure amount” according to Board Chairman Jürg Rötheli. The Defence Department was not even informed before the payment went out, which directly contradicted BACS recommandations. A review concluded no laws were broken, but the optics of a defence contractor wiring money to cybercriminals are obviously not great.
Comparis (2021). The Grief ransomware group paralysed Switzerland’s biggest comparison platform in July 2021. Comparis first denied paying, then confirmed it three weeks later after the attackers had demanded roughly 400,000 dollars in cryptocurrency. Comparis said they needed to recover “operationally essential files” that could not be restored otherwise.
The silent majority. These two are just the visible cases, and of the 54% that pay, 65% negotiate the price down by ca. a quarter on average, which is better than the global average of 53%. Swiss companies apparently treat ransomware less as a moral question and more as a calculated buisness risk.
Who refused
Bernina (2023). This one is my favourite. ALPHV/BlackCat hit the Thurgau sewing machine manufacturer, encrypted over 30 volumes, wiped backups and demanded 1.3 million dollars. Bernina’s response: they sent the attackers ten dollars as a deliberate provocation to buy time while they worked on restoring systems. Over 200 GB of stolen data got published, but Bernina recovered operations independently. Ten dollars instead of 1.3 million.
Stadler Rail (2026). The Everest group demanded 12.3 million dollars from the Swiss rail vehicle manufacturer. Stadler refused and filed a criminal complaint, after which 201 GB of data got dumped, but the breach came through a supplier’s file sharing platform rather than Stadler’s own systems, so production never stopped.
Xplain (2023). The Play group breached this government IT provider and Xplain refused to pay, resulting in roughly 900 GB of federal administration data in the Darknet, over 9,000 objects, more than half containing sensitive information from fedpol and customs. The investigation found failures on both sides.
NZZ and CH Media (2023). Play again, and neither paid. 500 GB dumped including salary lists, and the newspapers ran at reduced capactiy for days but kept going. Gemeinde Rolle (2021): Vice Society published 32 GB of resident data, and the commune got criticised not for refusing to pay but for waiting almost a month before communicating the breach… Groupe 3R: hit twice in 12 months (2025 and 2026), refused both times and stayed operational, which also proves that not paying alone doesn’t prevent future attacks.
Legal situation
Paying a ransom is not explicitly illegal in Switzerland, but several criminal code provisions could apply indirectly: support for a criminal organisation (Art. 260ter), terrorism financing (Art. 260quinquies) and money laundering (Art. 305bis). In practice victims almost never get prosecuted since the intent is not there, but board members face personal liability under duty of care rules if the decision is poorly documented, something that comes up in practically every tabletop exercise we run.
Switzerland joined the Counter Ransomware Initiative in November 2023 with 50 states pledging their governments won’t pay, which is politically significant but not legally binding and does not apply to private companies.
BACS position
Clear and unchanged: do not pay. Since April 2025 critical infrastructure operators must report attacks within 24 hours, and since October 2025 not reporting costs up to CHF 100,000. The FINMA flagged a 30% jump in cyber risk reports and named Play, Akira and LockBit 3.0 as the top threats for the Swiss financial sector.
BACS numbers show the trend: 44 ransomware incidents in H1 2024, rising to 79 in H2 2025 (+59%), then 72 in H1 2026. Akira alone targeted about 200 Swiss companies in 18 months, with average recovery costs of ca. 1 million dollars per incident.
The actual decision
You typically have five to seven days to decide, and in our experience from incident response engagements we see the same pattern repeatedly: organisations that think about the ransom question for the first time during an active attack consistently make worse decisions.
Against paying: you fund criminals, there is no guarantee the decryptor works, stolen data may get published regardless, and you become a known payer which means other groups will target you. For paying: sometimes the backups are simply gone, because groups like Akira destroy backup infrastructure first before triggering encryption, and when patient safety or business survival is at stake the moral arguments get harder to maintain.
The variable that changes everthing is backup integrity. Bernina recovered because they had alternative restoration paths, and many companies that pay simply do not have that option.
What to do
Offline immutable backups. 3-2-1 rule: at least one copy physically disconnected and immutable, and test restores regularly because a backup that has never been restored is a wish, not a plan.
Network segmentation. Every major case here involved lateral movement, and segmentation does not prevent the fire but stops it from burning down everything.
MFA on all remote access. VPN gateways, admin interfaces, cloud services: still one of the most common entry points in our penetration tests.
Patch management. Akira exploits known Fortinet and Cisco vulnerabilites, and the window between patch release and exploitation is now days, not weeks.
Incident response plan. Written down and tested, including the ransom decision. An annual tabletop exercise with the scenario “ransomware on Friday evening” will reveal gaps, guaranteed…
Could your organisation recover without paying? If you are not sure, lets talk.
Sources:
- Netzwoche: Sophos Report – Schweizer Firmen zahlen oft, verhandeln geschickt
- SRF: RUAG zahlt Lösegeld an Hackergruppe
- NZZ: Comparis bezahlt Lösegeld an Cyber-Erpresser
- Tagblatt: Bernina zahlt nur 10 Dollar statt 1,3 Millionen
- SRF: Xplain Cyberangriff
- HÄRTING: Ransomware-Lösegeld – legal oder tabu?
- BACS: Ransomware Empfehlungen