In brief: RUAG pays ransom to ransomware group, defying recognized guidelines that view payments as reinforcing cybercriminals’ business model.
Swiss defense contractor RUAG has paid ransom to ransomware group Akira following a cyberattack in November 2025. In doing so, the company disregards years of warnings from authorities and security researchers who view such payments as reinforcing cybercriminals’ business model.
In November 2025, RUAG’s US subsidiary Mecanex was attacked by Akira. According to the group’s claims, they copied approximately 24 gigabytes of company data, including employee records with Social Security numbers and ID copies, as well as military documents, contracts, and instructions for handling explosives. The stolen documents were published on the group’s darknet platform.
RUAG Chairman Jürg Rötheli publicly confirmed the payment in an SRF Saturday interview: “We paid, a small amount fortunately, and we got all the data back.” According to Rötheli, internal committees and US legal experts were involved in the decision. The Swiss Defense Department (VBS) stated it was not consulted in advance. RUAG argues that the return of the data limited the overall damage.
There is massive criticism from the political side. SVP National Councillor Mauro Tuena, himself an IT company operator, warns of a signaling effect: the payment signals to Akira that ransom can be obtained from Swiss federal companies. RUAG disputes this assessment, but is contradicted by security researchers.
From the perspective of security experts, the structural problem is clear: every sum paid confirms ransomware as a profitable business model and motivates further attacks. There is also a significant uncertainty: the Hiscox Cyber Readiness Report shows that 64 percent of affected companies do not recover their data after ransom payment, or recover it only partially. Stolen data can also be resold independently of a payment or used again later as leverage.
Source: www.it-daily.net · Published June 10, 2026
Lumi AI News — AI-assisted curation according to Art. 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.6.5.