Golf-schoenenberg.ch targeted by Qilin ransomware group

• Ransomware group: Qilin
• Country: Switzerland
• Sector: Hospitality
• Announcement date: June 5, 2025

Qilin ransomware group claims data breach at golf-schoenenberg.ch

The Qilin ransomware group has published an announcement on its leak site, claiming to have compromised data belonging to golf-schoenenberg.ch. This latest claim follows a pattern of activity by the group, which has targeted various organizations across different sectors. The announcement, made on June 5, 2025, indicates that the group is asserting control over information associated with the Swiss entity.

Details of the alleged attack

According to the claims made by the Qilin ransomware group, golf-schoenenberg.ch has been added to their list of victims. The group has stated that the data belonging to the organization is scheduled to be made available for download on June 16, 2025. To support their claims, the group has provided a screenshot that displays visual evidence of files that are alleged to have been exfiltrated from the organization's systems.

Ransomware leak sites serve as a platform for threat actors to pressure victims into paying ransoms. These sites often host countdown timers or specific dates to increase psychological pressure on the target. In this instance, the group has set a specific timeframe for the potential release of the stolen information, a common tactic used to create urgency during negotiations.

Information regarding the exfiltrated data

Regarding the specifics of the breach, there is no detailed information provided concerning the nature of the exfiltrated data. While the group has provided a screenshot showing some file samples, the exact contents and the full scope of the data theft remain unconfirmed. The listing does not specify the volume of data or the specific number of files involved in the incident.

Organization profile

Schönenberg Golf and Country Club is a private golf club located in Schönenberg, Switzerland. The facility features an 18-hole golf course that was established in 1967. As a private club, it serves a specific membership base within the hospitality and leisure sector.

Implications and potential risks

The Qilin group is known to operate using a double-extortion model. In this model, attackers do not just encrypt an organization's data to halt operations; they also steal sensitive information to use as leverage. The threat of publishing the organization's data is used to coerce the victim into paying a ransom, even if they have backups to restore their systems. The publication of the organization's data may lead to the exposure of member information or operational records.

Because the organization is based in Switzerland, a potential data breach may fall under the scope of the Swiss Federal Act on Data Protection (FADP). This regulatory framework governs how personal data must be handled and protected. A breach of this nature could result in significant reputational damage and legal sanctions for the organization. Furthermore, the leaked data may be utilized by threat actors for future identity theft or targeted phishing attacks against the organization or its members.

For organizations in the hospitality and private club sectors, maintaining robust cybersecurity postures is essential. Common defensive steps include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training for staff. Protecting member data is not only a technical requirement but a critical component of maintaining trust and complying with regional data protection laws like the FADP.