Nydegger + Finger AG listed on killsec leak site

• Ransomware group: killsec
• Country: Switzerland
• Sector: Professional Services
• Announcement date: April 1, 2025

Swiss engineering firm targeted by killsec

The Swiss-based architecture and planning firm Nydegger + Finger AG has been listed on the leak site of the threat actor known as killsec. The group claims to have obtained data belonging to the organization and has initiated a countdown timer on their platform. According to the announcement, the stolen information will be published if a ransom is not paid.

Details of the claim

The incident was announced on April 1, 2025, with the threat actor claiming the attack occurred on the same day. The listing follows a pattern common in modern cyberattacks where threat actors use public leak sites to exert pressure on victims. In these scenarios, the group typically employs a double extortion tactic, where they not only encrypt an organization's systems but also threaten to release sensitive data to the public to increase the likelihood of a ransom payment.

The group, killsec, is a threat actor that emerged in 2023. Reports indicate that the group has hacktivist origins and operates by providing ransomware-as-a-service. This model allows various affiliates to use the group's infrastructure to carry out attacks, often aiming to disrupt an institution's operational continuity through high-pressure tactics.

Potential data exposure

Based on the information provided by the threat actor, the leaked data appears to include a variety of sensitive professional and administrative files. The presence of these documents suggests a significant breach of proprietary information. The specific types of data mentioned in the listing include:

• Engineering projects
• Structural analysis reports
• Technical drawings
• Administrative documents
• Personal contact information

The inclusion of personal contact information alongside technical documentation increases the risk profile of the breach, as it may facilitate further social engineering or phishing attempts against the organization's personnel.

About Nydegger + Finger AG

Nydegger + Finger AG is a professional services firm based in Switzerland. The company specializes in architecture and planning, providing a range of services that include architectural design, urban planning, and construction management. Given the nature of their work, the firm handles complex technical data and sensitive project details essential to the construction and design sectors.

Risk assessment and implications

This potential leak poses several significant risks to Nydegger + Finger AG. The exposure of engineering projects and technical drawings could result in the loss of trade secrets, which are vital to the firm's competitive advantage. Furthermore, because the firm operates within Switzerland, this incident may lead to legal consequences under the Federal Act on Data Protection (FADP), which governs how personal and sensitive data must be protected.

Beyond the immediate loss of intellectual property, the organization faces secondary risks. These include the potential for competitors to gain access to sensitive project details and an increased likelihood of targeted phishing attacks against employees using the leaked contact information. Such attacks often follow a breach, as criminals use the stolen data to craft highly convincing messages to further compromise the network or extract more information.

For organizations in the professional services and engineering sectors, such incidents highlight the necessity of robust defensive measures. Implementing strong access controls, maintaining regular offline backups, and conducting comprehensive employee training on phishing awareness are standard defensive steps. Additionally, organizations must ensure compliance with regional data protection laws to mitigate the legal and regulatory fallout that follows a data exposure event.