Rohner listed on Rhysida ransomware leak site

• Ransomware group: Rhysida
• Country: Switzerland
• Sector: Manufacturing
• Announcement date: February 23, 2026

Rohner claimed to be targeted by Rhysida ransomware group

The manufacturing company Rohner has reportedly been listed on the leak site associated with the Rhysida ransomware group. According to an announcement made on February 23, 2026, the group claims to have successfully gained access to the organization's internal systems. This development follows a pattern seen in modern cyber extortion campaigns where threat actors target specific industrial entities to exert pressure through public exposure.

The announcement made by the group on its dedicated leak platform includes a direct threat regarding the potential publication of the organization's data. This type of public naming is a common tactic used by ransomware groups to increase pressure on a victim organization during negotiations. While the listing has been made public, the specific details regarding the breach remain limited to the group's own claims.

Details of the claimed incident

The Rhysida group added Rohner to its leak platform on February 23, 2026. The group asserts that they have managed to infiltrate the organization's network and maintain access to their systems. This claim suggests a breach of the perimeter or an exploitation of internal vulnerabilities to achieve unauthorized access.

Regarding the specifics of the alleged theft, there is no information available regarding the nature of the data that has been targeted or taken. The group has not provided any screenshots or visual evidence to substantiate their claims of a successful intrusion. Furthermore, no specific details have been released concerning the volume of data involved or the specific files that were accessed during the incident.

Data involvement

The listing names no specific data types or categories of information that have been allegedly compromised.

The organization profile

Rohner is a manufacturing company based in Switzerland. The organization operates within the manufacturing sector, a sector that is frequently targeted by cybercriminals due to the critical nature of its operational processes and the potential impact of service disruptions.

Analysis and implications for the manufacturing sector

This incident may pose a significant risk to the organization's operational continuity. When a manufacturing entity faces a ransomware attack, the disruption to production lines and supply chain logistics can have immediate and far-reaching consequences. Furthermore, if a data breach has indeed occurred, the organization may face notification obligations under the General Data Protection Regulation (GDPR), depending on the nature of the information involved and the residency of the data subjects.

Given the Rhysida group's known use of the double extortion method, it is possible that any leaked data could be used in secondary attacks or identity theft attempts. Double extortion involves not only encrypting a victim's files to halt operations but also stealing sensitive data to threaten its public release. This tactic increases the pressure on the victim, as the threat of a data leak remains even if systems are restored from backups.

There is a potential risk of phishing attacks targeting the organization's customers and employees if sensitive contact information or internal communications are part of the breach. Threat actors often use stolen information to craft highly convincing social engineering campaigns to further exploit the organization or its partners.

In such scenarios, organizations in the manufacturing sector can benefit from robust defensive measures. These include implementing strict network segmentation to prevent lateral movement by attackers, maintaining offline backups to ensure operational continuity, and conducting regular security awareness training to mitigate the risk of phishing. Because information about the Rhysida group remains limited, organizations are advised to maintain a high state of vigilance against their tactics.