Federal Council appoints crisis management team for ransomware gang attack

The Federal Council has mandated a crisis team called “Data Outflow”. This to coordinate the work after the hacker attack on the company Xplain, made public by Watson. Numerous federal and cantonal institutions have been affected by the attack.

The cyberattack, which leaked more than 900 gigabytes of stolen data onto the dark web, has been attributed to the suspected Russian ransomware gang Play.

Why a crisis team?

The crisis team must continuously analyze and assess the strategic situation, coordinate internal work, provide internal and external information and develop the basis for further decisions of the Federal Council, as the state government announced on Wednesday.

“It must be ensured that this outflow of data does not continue and that something like this is no longer possible in the future,” Justice Minister Karin Keller-Sutter told the media in Bern. That is actually the goal of this crisis team. Keller-Sutter described the data outflow as “disturbing”.

As early as mid-June, the Bundesrat decided to set up the crisis team, as it was called. The aim was to complement the extensive work on the operational side. Since then, the crisis team has met twice and submitted proposals to the Federal Council for further action.

The Federal Council approved the mandate for the crisis management team on Wednesday. All departments, the Federal Chancellery and a representative of the cantonal directors of justice and police (KKJPD) are involved in the crisis team. It is headed by the Secretary General of the Federal Ministry of Finance (FDF).

Hackers used ransomware to attack a vulnerability on the servers of IT service provider Xplain and steal data from the federal government. Not receiving a ransom, they published Federal Offices of Police (Fedpol) and Federal Offices of Customs and Border Protection (BAMF) data on the dark web on June 3. They posted even more operational data from the federal administration on the dark web about two weeks ago. The federal prosecutor’s office has started proceedings.

Independent research

In addition, the Bundesrat has a mandate drawn up for an administrative inquiry. This should be investigated by an independent body as to whether, where and why the federal government’s security requirements have been poorly implemented, it said. “Today we cannot answer how it was possible for such a provider to access such data,” Keller-Sutter said.

The Federal Council has also decided to review existing contracts with federal IT service providers. Cyber ​​security must be improved and adapted so that the federal government can respond quickly to a hacker attack. He also wants to ensure that Xplain’s services for the federal government can in any case be guaranteed.

The federal government is currently evaluating and analyzing the incident and the affected data package. The Bundesrat expects this to take several weeks to months. Because it concerns several million files, it said.

The hacker attack and its far-reaching consequences

(sda)