Regionale Verkehrsbetriebe listed on play ransomware leak site

• Ransomware group: play
• Country: Switzerland
• Sector: Transportation
• Announcement date: April 2, 2025

The Swiss transportation organization Regionale Verkehrsbetriebe has been listed on the leak site of the ransomware group known as play. The group claims to have successfully compromised data belonging to the organization, marking a new incident involving the threat actor.

Details of the claimed attack

According to the announcement published on the group's leak site on April 2, 2025, the ransomware group known as play claims to have compromised data belonging to Regionale Verkehrsbetriebe. The listing indicates that the organization was subjected to a cyberattack on March 21, 2025. While the announcement was made in April, the timeline suggests the initial breach or intrusion occurred several weeks prior to the public posting on the leak site.

Data involved in the incident

Regarding the specifics of the breach, no specific details regarding the nature of the compromised or threatened data have been provided by the group. The listing names no specific data types.

About Regionale Verkehrsbetriebe

Regionale Verkehrsbetriebe (RVBW) is a public transport company providing services in the Baden region and surrounding areas of Switzerland. The organization is responsible for operating regional bus lines, serving as a key component of the local transportation infrastructure in its operational areas.

Risk assessment and implications

This incident may pose risks to the organization's operational continuity and data privacy. As an organization operating in Switzerland, it may face obligations under the Federal Act on Data Protection (FADP). The play group, which is known to employ double-extortion tactics, may utilize the exfiltrated data for secondary attacks or targeted phishing campaigns. In such scenarios, threat actors typically steal sensitive information and then threaten to release it publicly unless a ransom is paid, using the threat of data exposure to increase pressure on the victim.

There may be a risk of identity theft for the organization's customers and employees. Public information regarding this group is limited, and it is noted that the group has been active since 2022. When organizations face such threats, common defensive steps often involve enhancing monitoring capabilities, implementing strict access controls, and ensuring robust backup strategies are in place to maintain operational continuity during and after an attack.