Lift AG listed on dragonforce ransomware leak site

• Ransomware group: dragonforce
• Country: Switzerland
• Sector: Transportation
• Announcement date: April 13, 2026

Swiss elevator manufacturer Lift AG targeted by dragonforce

The Swiss-based elevator manufacturer Lift AG has been listed on the leak site of the ransomware group known as dragonforce. According to the announcement made on the group's platform, the organization has been targeted in a cyberattack that has resulted in a significant data breach.

Details of the claimed attack

The dragonforce group has claimed responsibility for the incident, alleging that they have successfully compromised the systems of Lift AG. The group asserts that the breach occurred on April 13, 2026. This type of announcement is a common tactic used by ransomware groups to exert pressure on victims, often as part of a double extortion strategy where data is not only encrypted but also stolen to be used as leverage for ransom demands.

In such scenarios, threat actors typically target sensitive corporate information to increase their bargaining power. While the specific methods used to gain access to the network have not been disclosed, the group's claim indicates a successful intrusion into the company's digital infrastructure. The announcement was officially posted on the group's leak site on April 13, 2026.

Data volume and content

Regarding the information allegedly stolen during the operation, the dragonforce group has provided limited specifics. The group claims to have obtained approximately 419.4 GB of data from the organization. However, there is no information provided regarding the specific nature or types of the files that were compromised.

The listing does not specify the following:

• The total file count of the stolen data
• The specific types of data (such as personal, financial, or intellectual property)
• The specific ransom demand amount

The lack of detail regarding the content of the 419.4 GB of data makes it difficult to immediately assess the exact scope of the sensitive information at risk, though the sheer volume suggests a substantial amount of corporate or operational information may be involved.

About Lift AG

Lift AG is a manufacturer based in Switzerland that specializes in elevator solutions. Founded in 1958, the company operates as an independent family business. Their professional scope includes providing new installations, modernization, and maintenance services for both residential and commercial buildings.

Potential risks and industry implications

This incident may pose significant risks to the business operations and customer data of Lift AG. Because the company is based in Switzerland, the incident may fall under the scope of the Federal Act on Data Protection (FADP). The publication of data can lead to various secondary risks, such as identity theft or targeted phishing attacks aimed at the company's employees and customers.

It is important to note that the dragonforce group reportedly operates a model that provides infrastructure to various affiliates. Consequently, it is possible that the attack was carried out by different threat actors using the group's framework. This complexity in ransomware operations can make attribution and incident response more challenging for the victimized organization.

For organizations in the transportation and manufacturing sectors, such incidents highlight the necessity of robust cybersecurity frameworks. To mitigate potential legal and reputational damage, organizations often find it necessary to manage breaches transparently and inform all affected parties. Defensive measures typically include maintaining rigorous patch management, implementing multi-factor authentication, and ensuring comprehensive data backup strategies are in place to protect against the evolving tactics of ransomware affiliates.