safepay ransomware group lists manno.ch on its leak site

• Ransomware group: safepay
• Country: Switzerland
• Announcement date: September 28, 2026

The manno.ch domain, which belongs to the Municipality of Manno in Switzerland, has been listed on the leak site of the safepay ransomware group. According to an announcement made by the group, the municipality has been targeted in a cyberattack involving a data breach.

The claims of the safepay group

The safepay group published an announcement on September 28, 2026, claiming to have compromised data belonging to the Municipality of Manno. In the announcement, the group states that it is employing a double-extortion strategy targeting the institution's administrative and local service data. Double extortion is a common ransomware tactic where attackers not only encrypt an organization's files to disrupt operations but also steal sensitive information to threaten its public release if a ransom is not paid.

The group's announcement includes general information regarding the operations of the municipality, but the group has not provided any specific details regarding the nature or the specific content of the allegedly compromised data. While the group has claimed the attack occurred on September 28, 2026, the listing remains a claim made by the threat actor.

Data involved in the incident

The listing names no specific data types that have been compromised. While the group claims to have targeted administrative and local service data, the specific nature of the compromised information has not been specified by the group.

About the Municipality of Manno

Manno is a municipality located in the canton of Ticino, Switzerland. The institution serves as the official municipal administration providing administrative services, local regulations, and infrastructure information to residents, businesses, and visitors.

Analysis and implications for local governments

This incident indicates that local government infrastructure may become a target for cyber threat actors. Given the role of the institution in providing public services, a leak could potentially lead to a loss of public trust and operational disruptions. Under the regulations of the Swiss Federal Data Protection and Information Commissioner (FDPIC), the institution may face legal obligations if personal data of citizens has been compromised.

The use of the double-extortion method could lead to disruptions in municipal services and the exposure of sensitive citizen data, potentially resulting in secondary risks such as identity theft. Regarding the threat actor, the safepay group has been active since late 2024 and operates without an affiliate program. Because of this structure, it is assessed that the attacks may be coordinated directly by the group.

For organizations in the public sector, such incidents highlight the necessity of robust cybersecurity frameworks. To defend against such threats, organizations typically focus on implementing strong access controls, maintaining regular offline backups, and conducting comprehensive employee training to recognize phishing attempts. Additionally, monitoring for unauthorized data exfiltration and maintaining a clear incident response plan are critical steps for mitigating the impact of potential breaches.