INP Schweiz listed on Akira ransomware leak site

• Ransomware group: Akira
• Country: Switzerland
• Sector: Energy & Utilities
• Announcement date: March 20, 2026

Akira ransomware group claims data breach against INP Schweiz

The Akira ransomware group has listed INP Schweiz on its dedicated leak site, claiming to have stolen a significant amount of data. According to the announcement made on March 20, 2026, the group alleges that approximately 9 GB of data belonging to the Swiss-based firm has been compromised. While the group claims the attack occurred on February 25, 2026, they have not provided a specific ransom demand or any screenshots to verify the contents of the stolen data.

Ransomware leak sites are platforms used by cybercriminal groups to pressure victims into paying ransoms. In many modern attacks, threat actors employ a double-extortion strategy. This method involves not only encrypting an organization's internal systems to disrupt operations but also exfiltrating sensitive information. The attackers then threaten to publish this stolen data on public forums if the ransom is not met, leveraging the threat of reputational damage and regulatory scrutiny to increase their leverage over the victim.

Details of the alleged data theft

The Akira group's announcement suggests that the breach involves highly sensitive information related to the company's operations within the energy and transmission sector. The group claims that the compromised data includes a variety of internal and personal documents that could pose significant risks if released publicly.

The specific types of data allegedly included in the leak are:

• Employee personal information (passports, driver's licenses)
• HR files
• Financial documents
• Client files
• Contracts (including those with partners like Siemens)

The presence of such sensitive documentation, particularly identity documents like passports and driver's licenses, significantly elevates the severity of the incident. When personal identifiers are leaked, it often leads to secondary threats such as identity theft or highly targeted phishing campaigns aimed at the individuals involved.

About INP Schweiz

INP Schweiz AG is a specialized company providing engineering services to firms operating within the energy generation and transmission sector. The organization focuses on critical technical processes, specializing in concept development, planning, planning, commissioning, and testing processes. Given its role in the energy infrastructure sector, the company serves as a vital link in the technical lifecycle of energy production and distribution.

Risk assessment and industry implications

This incident highlights the growing risks faced by specialized engineering firms that support critical infrastructure. The potential exposure of sensitive contracts and client files can lead to significant commercial reputation damage and create complex supply chain risks for the organization's partners. Furthermore, because INP Schweiz is based in Switzerland, a confirmed breach of this nature could lead to legal sanctions under the Federal Act on Data Protection (FADP) and the General Data Protection Regulation (GDPR).

The group's history of targeting VPN accounts suggests that vulnerabilities in network security processes or remote access configurations may have been a primary vector for this intrusion. For organizations in the energy and utility sectors, maintaining robust security protocols is essential to protect against such sophisticated threats.

To mitigate these risks, organizations typically focus on strengthening their defensive posture through several key areas:

• Implementing multi-factor authentication (MFA) across all remote access points, particularly VPNs.
• Maintaining strict monitoring of network traffic to detect unauthorized data exfiltration.
• Conducting regular audits of access controls to ensure the principle of least privilege is enforced.
• Developing comprehensive incident response plans to address both data encryption and data exfiltration scenarios.

As of the current reporting, information regarding the Akira group remains limited, making it difficult to determine the full scope of their evolving tactics.