Radix listed on sarcoma ransomware leak site

• Ransomware group: sarcoma
• Country: Switzerland
• Sector: Healthcare
• Announcement date: June 19, 2025

Sarcoma group claims breach of Swiss health foundation Radix

The Swiss-based health foundation Radix has been listed on the leak site of the sarcoma ransomware group. According to the announcement made on June 19, 2025, the threat actor group claims to have successfully gained access to the organization's internal data. While the group has published the organization's name on its platform, public information regarding the specific identity and operational details of the sarcoma group remains limited.

Details of the claimed data leak

The announcement provided by the sarcoma group specifies the scale of the alleged incident. The group claims that the stolen data amounts to a total volume of 2 TB. According to the leak site post, the compromised information consists of various files. However, because no screenshots or specific file samples were provided by the attackers, the exact nature and specific types of the data involved remain unknown at this time.

The listing does not provide information regarding the following:

• The specific file formats or document types
• The exact number of files stolen
• The specific nature of the sensitive information contained within the files
• The ransom amount demanded by the attackers

In many modern ransomware campaigns, threat actors employ a tactic known as double extortion. In this scenario, attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data before the encryption process begins. The threat of leaking this stolen information on a public leak site serves as additional leverage to pressure the victim into paying the ransom. While the specific details of the demand in this case are unknown, the listing of an organization on a leak site is a common method used by these groups to demonstrate the success of their intrusion.

About Radix

Radix is a non-profit health education foundation located in Switzerland. The organization has been in operation since 1972. The primary mission of the foundation is to encourage municipal authorities and various decision-makers to recognize and implement health promotion as an important and ongoing task within their communities.

Potential impact and organizational risks

The claim of a 2 TB data leak poses significant risks, particularly given the organization's role within the healthcare sector. Because the organization handles matters related to health promotion and works with municipal authorities, the exposure of sensitive information could lead to serious consequences. If the claim is confirmed, the incident may trigger legal proceedings under the Federal Act on Data Protection (FADP) in Switzerland, as well as the General Data Protection Regulation (GDPR) depending on the scope of the data involved.

Beyond the immediate legal and regulatory implications, the organization's stakeholders and the municipalities it serves may face secondary risks. These risks include the potential for identity theft or the launch of targeted phishing attacks using the exfiltrated information. The sheer volume of the claimed 2 TB of data suggests a significant loss that could potentially impact the operational continuity of the organization.

For organizations operating in the healthcare and non-profit sectors, maintaining robust defensive postures is essential. Common defensive steps to mitigate such risks include implementing strict access controls, maintaining comprehensive logging and monitoring to detect unauthorized access, and ensuring regular, offline backups are maintained. Furthermore, organizations often focus on employee training to recognize phishing attempts and implement multi-factor authentication across all critical systems to prevent unauthorized entry into the network.