VBS finds Ruag’s hacker ransom payment lawful

Ruag acted within the law when it paid a ransom to hackers following a cyberattack on its US subsidiary, Switzerland’s Federal Department of Defence, Civil Protection, Sport (VBS) has concluded, SRF reported.

The Akira hacker group attacked the IT systems of Ruag subsidiary LLC in Virginia in autumn 2025 and stole data. The attackers then threatened to publish the information on the darknet and demanded a ransom.

Although the Swiss government had strongly advised against paying, the VBS investigation found that Ruag had not violated the law. As a private limited company, Ruag had examined compliance with US law and acted within its corporate responsibility. Government approval was therefore not required, the department said.

However, the investigation found that Ruag should have coordinated its communication with the Swiss government. According to the VBS, the company had not given sufficient consideration to the political and reputational consequences or to other broader interests.

To prevent similar incidents, Ruag will review its security measures and processes together with the Federal Office for Cyber Security. The review will also assess whether the group as a whole is adequately protected against cyberattacks.

Ruag board chairman Jürg Rötheli told Radio SRF that the company had paid a “small amount”. He did not disclose the exact sum but said it was “low”.