Ransomware gang Play hacks Swiss supplier of police software

The Bernese software company Xplain AG has been hacked by suspected Russian cyber criminals, according to research by Watson. A similar message was published Monday evening on the ransomware gang’s leak site Play on the dark web.

Director Andreas Löwinger confirmed on request that there had been a cyber attack. Customers were informed on Tuesday.

The accompanying statement, which Watson has available, reads:

Play is currently one of the most active cybercrime groups specializing in data theft and extortion. The cybercriminals do not belong in the ransomware-as-a-service (RaaS) provider category. This means that the hackers carry out their attacks themselves.

According to Xplain AG, no official data is affected

Those responsible are reluctant to comment on the size and seriousness of the cyber attack.

Xplain AG has its head office in Interlaken BE, offices in Aarau, Zurich and Lausanne and international branches in Germany and Spain.

The company’s website states:

The ransomware gang Play has repeatedly attacked Swiss companies in recent months. Known victims include the media companies NZZ and CH Media (to which Watson also belongs), but also the receivership of the Valais municipality of Saxon, as well as the company Energie Pool Schweiz and the hotel chain H-Hotels.

The number of unreported cases is probably relatively high. International investigations by IT security researchers have shown that many attacks go unreported or made public. Up to two-thirds of affected organizations respond to the blackmail and pay the ransom.