Dyhrberg AG Switzerland listed on Deadlock ransomware leak site

• Ransomware group: Deadlock
• Country: Switzerland
• Sector: Manufacturing
• Announcement date: July 10, 2026

The Deadlock ransomware group has listed the Swiss-based organization Dyhrberg AG Switzerland on its dedicated leak site. This announcement, made on July 10, 2026, follows the group's claim that it has successfully compromised the institution's data. While the listing has been made public on the threat actor's platform, the specific details regarding the nature of the breach remain unverified.

The claimed attack event

According to the announcement posted on the Deadlock leak site, the threat actor identified as Deadlock targeted Dyhrberg AG Switzerland on July 10, 2026. The group asserts that they have gained unauthorized access to the institution's systems and have successfully exfiltrated data. This type of activity is characteristic of modern ransomware operations, where threat actors often employ double extortion tactics. In such scenarios, attackers not only encrypt an organization's internal systems to disrupt operations but also steal sensitive information to use as leverage during ransom negotiations.

Despite the claim of a successful compromise, the current state of the leak site provides limited visibility into the actual impact of the attack. At the time of the announcement, the associated leak page did not display any data samples or specific file contents. Furthermore, attempts to access the purported leaked content resulted in an "HTTP 403" error, suggesting that the files may not be immediately accessible or that the page is restricted. Consequently, the accuracy of the threat actor's claims and the true scope of the data involved remain uncertain.

Data involvement and content

Regarding the specific information that may have been targeted during the attack, the listing currently provides no details. The threat actor has not specified the volume of data taken or the specific types of files that were exfiltrated. The listing names no data types.

In many ransomware incidents, the lack of immediate data samples can be due to various factors, such as the group's negotiation strategy or technical limitations. However, the absence of visible content on the leak site does not necessarily confirm that a breach did not occur; it simply means that no evidence of the stolen data has been made public through the group's platform at this time.

Organization profile

Dyhrberg AG is a Switzerland-based food manufacturing company. The organization specializes in fish processing and the production of salmon products. They are known for producing high-quality smoked fish products utilizing traditional manufacturing methods.

Risk assessment and industry implications

The claim made by the Deadlock group poses several potential risks to the organization and its stakeholders. If the threat actor's claims are accurate, the compromise of institutional data may pose a significant risk of identity theft for both employees and customers. Such breaches often involve personally identifiable information (PII), which can be exploited for fraudulent activities or used in subsequent targeted phishing campaigns against the organization or its clients.

Because Dyhrberg AG is based in Switzerland, any confirmed data breach may trigger specific legal obligations under the Swiss Federal Act on Data Protection (FADP). Organizations operating within this jurisdiction must adhere to strict regulatory frameworks regarding the handling and protection of personal data, and a breach may necessitate formal reporting to regulatory authorities and affected individuals.

For organizations within the food manufacturing sector, these types of cyber threats highlight the importance of robust cybersecurity defenses. While the specific details of this incident are still developing, common defensive steps for organizations include implementing multi-factor authentication, maintaining offline backups, and conducting regular security awareness training to mitigate the risk of initial access. Additionally, monitoring for secondary risks, such as the reuse of leaked data in future attacks, is a critical component of an effective incident response and threat intelligence strategy.