stuecheli.ch listed on Safepay ransomware leak site

• Ransomware group: Safepay
• Country: Switzerland
• Sector: Retail & E-Commerce
• Announcement date: October 5, 2026

The ransomware group known as Safepay has listed the Swiss-based architectural firm stuecheli.ch on its dedicated leak site. In an announcement made on October 5, 2026, the threat actors alleged that they have successfully conducted a data breach against the organization, claiming to have obtained information related to the firm's operations.

The claim by Safepay

According to the announcement posted on the group's leak site, the incident was reported on October 5, 2026, which coincides with the date the group claims the attack took place. The Safepay group has specifically targeted stuecheli.ch, asserting that they have gained access to data pertaining to the firm's architectural operations. The post provided by the attackers included various details regarding the firm's history and its various projects.

A significant aspect of this incident is the methodology employed by the threat actors. The group is noted for utilizing a double-extortion strategy. In such cyberattacks, threat actors do not merely encrypt an organization's files to demand a ransom for decryption; they also exfiltrate sensitive data before the encryption process begins. This allows the attackers to threaten the public release of stolen information if the ransom is not paid, creating a secondary layer of pressure on the victimized organization.

Details of the alleged data breach

While the group has claimed to have obtained data related to the firm's architectural activities, the announcement does not provide specific details regarding the nature of the allegedly compromised data. The listing names no specific data types or file counts.

About stuecheli.ch

Stuecheli.ch is a Swiss-based architectural firm with a long-standing history in the industry. Founded in 1946 by the architect Werner Stücheli, the firm is currently managed by the third generation of the family. The organization provides a variety of architectural design and planning services to its clients.

Impact and industry implications

Given the double-extortion tactics used by the Safepay group, there is a potential risk that the firm's sensitive architectural projects and business data could be published online. Because the firm is headquartered in Switzerland, a confirmed data breach could trigger mandatory compliance processes under the Swiss Federal Act on Data Protection (FADP) and the General Data Protection Regulation (GDPR).

The potential consequences of such a leak extend beyond the organization itself. Clients and business partners of the firm may be at risk of being targeted by sophisticated phishing attacks, as attackers often use stolen corporate information to craft convincing fraudulent communications. Furthermore, while information regarding Safepay's operational methods remains limited—as the group only emerged in late 2024—leaks of this nature can have a significant negative impact on a firm's commercial reputation.

For organizations operating in the professional services and architectural sectors, maintaining robust cybersecurity postures is essential to protect intellectual property and client confidentiality. Common defensive measures include implementing strict access controls, maintaining regular offline backups, and conducting employee training to recognize phishing attempts. As threat actors continue to evolve, understanding the risks associated with double-extortion remains a critical component of modern risk management.