VENZI & PAGANINI AG listed on qilin ransomware leak site

• Ransomware group: qilin
• Country: Switzerland
• Sector: Professional Services
• Announcement date: December 2, 2025

VENZI & PAGANINI AG targeted by qilin ransomware group

The threat actor known as qilin has listed the Swiss-based organization VENZI & PAGANINI AG on its dedicated leak site. According to the announcement made on December 2, 2025, the group claims to have successfully compromised the institution's data. This development marks a significant escalation in the threat landscape facing professional services firms in the region.

Details of the claimed attack

The qilin ransomware group has indicated that they are employing a double extortion strategy in this specific case. In a double extortion scenario, threat actors do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive information to use as leverage. By threatening to publish the alleged stolen data on their leak site, the attackers aim to pressure the victim into paying a ransom to prevent the public disclosure of the information.

The announcement was posted on the group's leak site on December 2, 2025, which coincides with the date the group claims the attack took place. This synchronization is common in ransomware operations, where the timeline of the breach and the subsequent public listing are closely linked to maximize psychological pressure on the target organization.

Status of the leaked data

Regarding the specific content of the alleged leaked data, the information remains unclear. While the threat actor has made claims regarding the compromise of the institution's data, the provided screenshots used to support these claims are blurred. Consequently, the specific types of files or the exact nature of the information involved cannot be clearly identified at this time.

• No specific data types were named in the listing.

Because the images provided by the group are obscured, it is impossible to determine the volume of data or the specific categories of information that have been targeted. The group has not provided details regarding the total file count or the specific size of the data allegedly exfiltrated during the breach.

Implications and potential risks

This situation poses several significant risks to the organization. Primarily, such an event may lead to major disruptions in the institution's operational processes. Beyond the immediate technical impact, the threat of data publication can cause substantial reputational damage to a professional services firm, where trust is a fundamental component of the business model.

Because VENZI & PAGANINI AG is based in Switzerland, a confirmed data breach could trigger complex legal proceedings under the Federal Act on Data Protection (FADP). The legal ramifications of such a breach involve strict regulatory requirements regarding the protection and handling of personal information.

Furthermore, the use of the double extortion method creates secondary risks for the institution's clients and employees. These risks include the potential for identity theft or the launch of targeted phishing attacks, where attackers use stolen information to impersonate legitimate entities or individuals. Given the historical activities of the qilin group, the possibility that the data will eventually be published or sold on illicit forums must be taken into serious consideration.

In general, organizations operating in the professional services sector can mitigate such risks by implementing robust data encryption, maintaining rigorous access controls, and conducting regular security audits. Monitoring for unauthorized data exfiltration and establishing a comprehensive incident response plan are also critical defensive steps for any organization facing sophisticated ransomware threats.