In early June, the IT services provider Xplain, based in Bern, Switzerland, experienced a Play ransomware attack that had a more significant impact than initially anticipated. The attack not only affected Xplain, but also targeted the national railway company of Switzerland (FSS) and the canton of Aargau. Swiss police launched an investigation into the incident.
The news of the attack was first reported by Swiss newspaper Le Temps, which highlighted that several cantonal police forces, the Swiss army, and the Federal Office of Police (Fedpol) were indirectly impacted by the cyberattack. These entities shared a common IT service provider, Xplain, which had been hacked.
Threat actors initially published alleged stolen data from Fedpol and the Federal Office for Customs and Border Security (FOCBS) on a Darknet forum. Local media revealed that the attackers exploited a vulnerability in Xplain’s servers to carry out the attack.
Fedpol and the federal customs office confirmed the attack but downplayed its severity. Fedpol stated that the threat actors only accessed simulated, anonymous data used for testing purposes, ensuring that their projects remained unaffected. FOCBS acknowledged that some of their data exposed in the breach included correspondence with clients.
The FSS data leak was initially reported by NZZ am Sonntag magazine and later confirmed by the Swiss railway company. The authorities of the canton of Aargau also confirmed the data breach. Aargau authorities assumed that, in addition to company correspondence, a small amount of operational data from error logs, which were under analysis at Xplain, might have been affected.
The Aargau authorities said for their part that they assume that “in addition to company correspondence, a small volume of operational data from error logs which was at Xplain for analysis was also affected”, RSI reported.
The investigation into the security breach is still ongoing to determine the full extent of the attack and its implications for the affected organizations.
Additionally, during the same period, the website of the Swiss parliament faced a separate cyber attack. The president of the House of Representatives, reported that problems were encountered in accessing the website. However, the attack on the parliament’s website was not linked to the Xplain ransomware attack. Parliament’s services stated that the attack had been neutralized, assuring that no internal systems or data had been affected, although some access issues persisted temporarily.
Overall, the incident involving Xplain’s Play ransomware attack had far-reaching consequences, affecting not only Xplain but also the FSS, the canton of Aargau, and indirectly impacting various government entities in Switzerland.