Swissmem listed on Hunters International leak site

• Ransomware group: Hunters
• Country: Switzerland
• Sector: Manufacturing
• Announcement date: February 17, 2025

Hunters International claims data breach at Swissmem

The ransomware group known as Hunters International has claimed responsibility for a data breach targeting Swissmem. According to an announcement posted on the group's leak site on February 17, 2025, the threat actors allege they have successfully exfiltrated sensitive information belonging to the organization. This incident follows a pattern often seen in modern cyberattacks, where groups utilize double extortion tactics to pressure victims into paying ransoms by threatening to release stolen data publicly.

In such scenarios, ransomware groups typically target high-value organizations to maximize leverage. Once data is exfiltrated, the group often hosts it on a dedicated leak site to demonstrate the validity of their theft. This public pressure is designed to damage the reputation of the victim and force a settlement. While the group has listed the organization, the specific details regarding the volume of data or the exact ransom amount demanded have not been provided in the announcement.

Details of the alleged extortion attempt

The Hunters International group has stated that the decision to publish the stolen data was a direct result of failed negotiations. According to the group's claims, they attempted to engage with the management of Swissmem to reach a resolution, but these discussions were ultimately unsuccessful. The group further alleges that the organization refused various opportunities that were presented to them to secure their data and prevent its public exposure.

The group's announcement includes visual evidence to support their claims, such as screenshots containing samples of sensitive documents. These images are intended to prove that the attackers have indeed gained access to internal files. This method of verification is a common tactic used by ransomware operators to build credibility within the cybercriminal underground and to increase the psychological pressure on the victimized entity.

Sensitive information allegedly leaked

The data identified in the leak appears to contain highly sensitive personal and corporate information. The announcement specifies that the following types of data have been compromised:

• Management salary information
• Director passport copies
• Corporate contact lists

The inclusion of identity documents, such as passport copies, significantly elevates the severity of the breach. Such information is highly prized by malicious actors for various illicit purposes. The exposure of management salaries and contact lists further compromises the internal privacy and operational security of the organization.

About Swissmem

Swissmem is the leading industry association for the Swiss mechanical, electrical, and metal industries. It represents its member companies at national and international levels, providing training, consulting, and networking services to enhance the competitiveness of the sector.

Risk assessment and industry implications

The alleged leak of sensitive personal information, particularly identity documents and salary details, poses significant long-term risks. For the individuals involved, such as directors and employees, the exposure of passport copies and contact information increases the risk of identity theft and highly targeted phishing attacks. These attackers may use the stolen details to craft convincing social engineering schemes to further penetrate the organization or its partners.

From a regulatory perspective, because Swissmem is based in Switzerland, this incident may fall under the scope of the Swiss Federal Act on Data Protection (FADP). Organizations operating within this jurisdiction must be mindful of strict data protection requirements and the potential legal ramifications of a data breach. Furthermore, there may be secondary risks to the organization's business partners and customers, as the breach could potentially provide a foothold for lateral movement or further attacks within the broader supply chain.

The technical profile of the threat actor is also notable. The fact that Hunters International is reported to be based on the Hive codebase suggests that the group may possess significant technical capabilities. This is an important consideration for defenders, as groups utilizing advanced codebases often employ sophisticated methods to bypass traditional security measures. Additionally, the group's reported cessation of encryption activities in 2025 may indicate a shift in their operational strategy, potentially moving toward pure data exfiltration and extortion rather than traditional file encryption.

For organizations in the manufacturing and industrial sectors, this incident highlights the importance of robust data protection strategies. Defensive measures typically include implementing multi-factor authentication, maintaining rigorous patch management, and conducting regular security awareness training to mitigate the risk of phishing. Furthermore, ensuring comprehensive logging and monitoring can help in detecting unauthorized data exfiltration attempts before they escalate into public leaks.