There are moments in book research when the present, unasked, lays the next chapter on your desk.
For months I have been working on my book «Daten in fremder Hand» (Data in Foreign Hands) — about how Switzerland is losing its digital sovereignty and how authorities, companies and citizens can reclaim it. One of the chapters examines the cyberattack on RUAG that began in 2014: back then, presumably state actors lodged themselves in the defence group's network with the Turla espionage software, moved through the systems undetected for more than a year, and in the end carried out around 23 gigabytes of data. The intrusion was only discovered in early 2016. The report published at the time by the federal Reporting and Analysis Centre reads like a textbook on patience — the patience of the attackers, not of the defenders.
So while I am sitting in the files of 2014, comparing reports and reconstructing timelines, something happens that I would not have dared to invent as an author, because it would seem too crude: RUAG gets hacked again. And this time, it pays.
An Office with Eight Employees
The new case takes place not in Bern but in Herndon, Virginia. That is where RUAG LLC sits, formerly Mecanex USA, a wholly owned subsidiary of RUAG MRO Holding AG — the group that belongs one hundred percent to the Swiss Confederation. Eight employees, a liaison office to the American defence market. Sounds like periphery, like a footnote in the organisational chart.
But it is not. Through this small office flow contracts, export-control documents and technical files relating to spare-parts procurement for the F-5 Tiger and F/A-18 Hornet fighter aircraft — the backbone of the Swiss Air Force. Add to that its role as subcontractor in the US Navy's ARTEMIS project, in which RUAG overhauls the engines and structures of 22 F-5 jets. Anyone who has ever specified an interface as an engineer knows the pattern: everything accumulates at the interface. Exactly where the organisation is most thinly staffed, the data is most densely concentrated.
The Attack
In November 2025, the ransomware group Akira struck. On 3 November, it claimed responsibility for the intrusion on its leak site on the darknet and threatened to publish 24 gigabytes of stolen data.
Akira is no backyard phenomenon. The group has existed since March 2023, is regarded by the FBI, CISA and Europol as a successor organisation from the milieu of the notorious Conti group, and operates on the "ransomware as a service" model: the core developers build the encryption software, infrastructure and payment portals, affiliates carry out the actual intrusions, and the loot is shared. By 2025, the group had extorted more than 244 million US dollars. And it had discovered Switzerland as a hunting ground: in autumn 2025, the Federal Office for Cybersecurity counted four to five Akira attacks per week on Swiss companies, around 200 victims in total.
The course of events in Virginia followed the group's documented playbook: entry via poorly secured perimeter systems — typically a VPN interface without multi-factor authentication, or stolen credentials —, then digging in within the network using legitimate remote-administration tools, reconnoitring the directory services, disabling the protection software, deliberately destroying the backups. Only when the data had long since landed on foreign servers did the encryption come — the loud part of the attack, which in truth is merely the final chord.
Among the 24 gigabytes: social security numbers and ID copies of employees, military contracts and procurement documents relating to the F/A-18 and F-5, internal instructions on the handling of explosives, non-disclosure agreements with American authorities and defence companies. RUAG stressed that the US systems ran autonomously and that the Swiss core network had not been affected. That may be true. But it merely shifts the point: after 2014, the headquarters had been fortified — and the outpost forgotten, where the same sensitive documents were stored.
The Payment
On 6 June 2026, board chairman Jürg Rötheli admitted in the «Samstagsrundschau» programme of Radio SRF what until then had only been suspected: RUAG paid the extortionists a ransom. "We paid, a small amount, and fortunately got all the data back," he said. How small "small" is remained open; empirical analyses of Akira negotiations — the median of the sums actually paid is around 150,000 US dollars — point to a six-figure amount.
One can understand the decision in business terms. RUAG took advice from American lawyers, and their calculation is simple: in the USA, lost social security numbers threaten class actions, breached non-disclosure agreements with the Pentagon threaten the withdrawal of clearances. Against those sums, a six-figure ransom looks like a bargain.
But this is exactly where an IT incident becomes a sovereignty problem. The Federal Office for Cybersecurity officially and emphatically advises against paying ransoms — every payment finances the next wave of attacks, and there is no guarantee anyway: industry figures show that almost two thirds of paying companies still do not get their data back, or only incompletely. A federally owned group has thus overridden the explicit doctrine of its own owner. And more than that: the DDPS — the department that represents the Confederation's ownership interests — was neither informed nor consulted before the payment. The group's leadership decided alone to pay a criminal organisation with state money, presenting Federal Councillor Martin Pfister with a fait accompli.
The reactions in Parliament were accordingly sharp. SVP National Councillor Mauro Tuena called the payment a "fatal signal" to the cyber underworld. His fellow councillor Franz Grüter put it in one sentence: "Whoever pays a ransom shows cybercriminals that their extortion attempts pay off." Green National Councillor Gerhard Andrey demanded that the group's cybersecurity finally be improved structurally instead of covering up problems with ransom money. The Federal Council drew the institutional consequence and is pushing ahead with the conversion of RUAG into a company governed by special legislation — the short leash on which Swiss Post, the SBB railways and Swisscom are also led.
Twelve Years, Two Attacks, the Same Lesson
What electrifies me about this case as an author and leaves me at a loss as an engineer is the symmetry. 2014: attackers break in, remain undetected for over a year, exfiltrate around 23 gigabytes. 2025: attackers break in, exfiltrate 24 gigabytes. In between lie twelve years, a national security report, a newly created federal cybersecurity authority, countless strategy papers — and in the end almost the same number on the damage report.
Of course the cases differ technically. 2014 was patient state espionage, 2025 fast, commercial extortion. But the root is the same, and it is not technical in nature. It sits one floor higher.
The Empty Seat on the Board
I have seen enough boards of directors in my professional life to know how these bodies are composed: a finance profile, an industry profile, a legal profile, someone with a political network. That is not wrong. But for a defence group that belongs to the Confederation, whose business rests on data requiring secrecy, and which has demonstrably been in the crosshairs of intelligence services and extortion syndicates for more than a decade, it is simply no longer explicable in the year 2026 that no proven IT security expert sits at the table.
The ransom decision illustrates the deficit precisely. Consulted: American liability lawyers. Not consulted: the owner and its cybersecurity authority. That is the outlook of a body that understands cyber risk as a legal damages issue — something to be priced in after the incident — and not as a strategic leadership issue to be shaped before the incident. A board with security expertise would have asked different questions long before Akira knocked: Why is an outpost holding ITAR documents and explosives handbooks hanging off a VPN whose hardening we do not verify ourselves? Why does our protection standard apply only where the organisational chart is thick? And who picks up the phone in a crisis — the lawyer or the Confederation?
This is not about a quota for IT specialists. It is about what is called security governance, which plainly means: someone in the top body must be able to ask the right questions before the answers weigh 24 gigabytes.
What This Has to Do with Digital Sovereignty
«Daten in fremder Hand» — the book title was meant as a diagnosis, not a prophecy. The RUAG case shows in compressed form what the book describes at large: digital sovereignty is rarely lost with a bang. It is lost in organisational charts, in gaps of responsibility, in boards without security expertise, in outposts that no one has on their radar, and in pragmatic individual decisions that are sound in business terms and devastating in terms of statecraft.
And it does not come back with a bang either. It comes back with structures: with bodies in which security expertise carries a vote instead of merely advising; with owners who enforce their doctrine instead of publishing it; with the insight that the periphery of an organisation deserves the same protection as its centre — because the attackers stopped making that distinction long ago.
The chapter on RUAG in my book is getting longer than planned. The present is writing along.
The Full Analysis as PDF
For those who want to dig deeper: my ten-page cyber analysis of the Akira attack on RUAG LLC — forensic reconstruction of the kill chain, data breach assessment, assessment of the ransom payment and the political consequences — is available here as a PDF download. (In German.)
Download the RUAG / Akira cyber analysis (PDF, in German)
Sources and Further Reading
- SRF: Trotz Warnung — Bundeskonzern Ruag zahlt Lösegeld an Hackergruppe (in German)
- SRF Samstagsrundschau, 6 June 2026: Wann kehrt bei Ruag Ruhe ein, Herr Rötheli? (in German)
- Swissinfo: Ruag hat nach Hackerangriff Lösegeld an Erpresser bezahlt (in German)
- RUAG: Security incident at RUAG's American subsidiary
- IT-Markt: US-amerikanische Ruag-Tochter zahlt Lösegeld an Ransomware-Erpresser (in German)
- Blick: Ruag-Affäre empört das Parlament (in German)
- FBI/CISA: #StopRansomware: Akira Ransomware — Cybersecurity Advisory
- Cash: Wie viel Geld Hacker von ihren Opfern verlangen (Sophos study 2025 and Tinbergen analysis of Akira negotiations; in German)
- SP Switzerland: Statement on the change of legal form of RUAG MRO Holding AG (in German)