ara-lyss.ch listed on safepay ransomware leak site

• Ransomware group: safepay
• Country: Switzerland
• Sector: Professional Services
• Announcement date: September 15, 2026

Swiss wastewater treatment organization ara-lyss.ch targeted by safepay

The ransomware group known as safepay has published an announcement on its leak site claiming to have compromised data belonging to ara-lyss.ch. The announcement, which appeared on September 15, 2026, indicates that the group has successfully targeted the organization's infrastructure and operational information. This development suggests that the threat actors are employing a double-extortion strategy, a method where attackers not only encrypt an organization's systems but also threaten to leak sensitive data to increase pressure on the victim.

Details of the claimed attack

According to the announcement made by the safepay group, the breach was claimed to have occurred on September 15, 2026. The group's communication indicates a specific focus on the organization's infrastructure and the information required for its operations. By listing the organization on a public leak site, the group aims to create visibility for the breach, using the threat of data exposure as leverage to demand a ransom.

Double extortion is a common tactic used by modern ransomware groups. In this scenario, the attackers aim to maximize their leverage by targeting the confidentiality of data. Even if an organization has robust backup and recovery procedures to restore its systems, the threat of leaking sensitive information can force the organization to consider the attackers' demands to avoid reputational damage or regulatory scrutiny.

Data involved in the incident

Regarding the specific details of the breach, the available information remains limited. Neither the provided screenshots nor the registration records contain specific details regarding the types of data leaked. Consequently, it is assessed that the organization's operational and administrative information may be at risk, though the exact nature of the files has not been disclosed by the group.

About ara-lyss.ch

ARA Lyss is an organization based in Lyss, Switzerland, that operates wastewater treatment facilities in the region. It is responsible for the treatment of industrial and domestic wastewater in the city.

Impact and assessment of the threat

This incident may create negative impacts on the organization's operational continuity and could lead to the exposure of critical infrastructure data. Because the organization operates within Switzerland, any potential data leaks may trigger legal processes under the General Data Protection Regulation (GDPR) and local data protection regulations.

The use of the double-extortion method by the safepay group may increase the pressure on the organization, potentially paving the way for secondary risks such as identity theft or targeted phishing attacks. The fact that the safepay group emerged in late 2024 suggests that their operational methods may still be evolving, which highlights the importance for organizations to take proactive measures against such threats.

For organizations operating in critical sectors, such as those managing essential public services, maintaining high levels of cybersecurity is vital. Defensive strategies often include implementing multi-factor authentication, maintaining offline backups, and conducting regular security audits. Furthermore, as threat actors continue to refine their methods, organizations must remain vigilant against evolving tactics used by emerging ransomware groups to protect both their operational integrity and the sensitive data they manage.