Swiss Government Reports Data Breach After Play Ransomware Attack on IT Vendor Xplain

The Swiss government has reported that in a recent Play ransomware attack on IT vendor Xplain, attackers may have gained access to operational data. Last week, the Swiss government announced that it was affected by an attack on Xplain, a vendor that provides various government departments, administrative divisions and even the country’s armed forces with software solutions.

Xplain Hacked by Play Ransomware Group

On May 23, 2023, Xplain was hacked by the extortionate group Play, and the attackers immediately stated that they had stolen various documents from the company containing personal and confidential data, financial and tax information, and so on. On June 1, 2023, the group published a full dump of the stolen data on their dark web site, as they apparently could not force Xplain to pay the ransom.

Operational Data May Have Been Affected

Swiss authorities have now said that although the investigation into the incident is still ongoing, it is likely that the attackers leaked information belonging to the Swiss Federal Council into the public domain.
“Currently, specific [affected] units and data are being specified and determined,” reads the official press release from the authorities. “Contrary to initial findings, following recent in-depth clarifications, it should be assumed that operational data may also have been affected [during the attack].”

DDoS Attack Launched by Pro-Russian Hacker Group NoName

In addition, soon the government of the country published a second press release, which warns of problems with access to various Federal Council websites and online services. The cause of this failure was a DDoS attack launched by the pro-Russian hacker group NoName, a pro-Russian hacktivist group that has been attacking countries and organizations associated with NATO since early 2022.
The Swiss government is currently working to determine the extent of the data breach and the damage caused by the attack. In the meantime, the government has urged all citizens to be vigilant and to take extra precautions when it comes to their online security. It is also important to note that the government has not yet confirmed whether any sensitive data was leaked as a result of the attack.
The incident highlights the importance of cybersecurity and the need for organizations to take measures to protect their data from malicious actors. In addition, it is essential for organizations to have a comprehensive security strategy in place that includes regular backups, strong authentication, and other measures to ensure that their data is safe from unauthorized access.
The Swiss government has also urged citizens to be aware of the risks associated with ransomware attacks and to take steps to protect their data from such threats. This includes regularly updating their software and using strong passwords, as well as avoiding suspicious links and emails.
The incident is a reminder that cyber-attacks can have serious consequences, and that organizations must take steps to protect their data and systems from malicious actors. The Swiss government is currently working to determine the extent of the data breach and the damage caused by the attack, and it is important for organizations to take measures to ensure that their data is secure.