Breaches and incidents
Medienwerkstatt AG (Mattenbach group), Sulgen: ransomware, business contact, production, order data and images copied
The company’s notice says unusual activity was detected on Friday 9 Oct 2026, unauthorized third parties temporarily accessed parts of its IT, and “die...
- Disclosed
- Verification
- Checked against a primary source
What happened
- The company’s notice says unusual activity was detected on Friday 9 Oct 2026, unauthorized third parties temporarily accessed parts of its IT, and “die Angreifer Daten kopiert haben”: business contact data, production and order data and image files of some customers. Netzwoche (26 Oct) describes it as a ransomware attack that affected individual systems. The KonBriefing claim that a payment provider’s merchant data was affected does not appear in either source.
- Root cause: not disclosed.
- The company names no attacker; Netzwoche reports, citing Hacksnack, that Akira claimed the attack and 130 GB on its leak site (group claim, not confirmed by the company).
- Systems were restored from backups and production is running normally; the company says concessions to the attackers were not an option, reported to the EDOEB and filed a criminal complaint; other Mattenbach units were not affected.