Loading story…
Stiftung Wagerenhof in Uster, Zurich, disclosed that a ransomware attack hit its virtual IT environment, blocking access to multiple systems and encrypting data. The attackers later issued a ransom demand after the intrusion, disrupting the foundation’s operations and prompting the organization to publish ongoing public updates about the incident.
The foundation said it shut down all systems and connections immediately after detecting the attack and brought in external ICT and cybersecurity specialists to support containment and recovery. Cantonal police were involved, the incident was reported to Switzerland’s Federal Office for Cybersecurity (BACS), and a criminal complaint was filed; Wagerenhof also said it would not pay the ransom.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
The foundation stated that it refused to comply with the attackers' ransom demand. This marked its public position on the extortion attempt tied to the ransomware incident.
Following the attack, the foundation shut down all systems and connections and brought in external ICT and cybersecurity partners to respond to the incident. It also involved the cantonal police, notified Switzerland's Federal Office for Cybersecurity (BACS), and filed a criminal complaint.
On the evening of 2026-07-09, Stiftung Wagerenhof said attackers struck its virtual IT environment in Uster, blocking access to multiple systems and encrypting data. The attackers later sent a ransom note demanding payment.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Sapienza University of Rome (La Sapienza)** suffered a major cyber incident that forced the institution to take critical IT systems offline, leaving core digital services disrupted for several days and the university website unavailable. The university publicly acknowledged the attack via social media, stating it shut down systems as a precaution to protect data integrity while it investigated and worked to restore services; it also indicated some channels (including email and workstations) were only partially available and that recovery efforts were proceeding using backups believed to be unaffected. Italian authorities were notified and Italy’s national cybersecurity agency (**ACN**) is reported to be investigating. While the university has not formally attributed the incident, Italian media reporting cited by both outlets described the disruption as consistent with a **ransomware** operation, including claims that attackers provided a ransom-demand link featuring a **72-hour countdown** that begins only after the link is clicked; separate reporting also linked the activity to **BabLock** ransomware, though this attribution has not been officially confirmed. To reduce impact on students and staff during the outage, the university also set up temporary in-person “infopoints” to provide access to information normally delivered through unavailable digital systems.
Jun 29, 2026
Stadler Rail said a cyberattack targeted a data-exchange platform operated by one of its suppliers after attackers obtained compromised login credentials, allowing access to certain technical data. The company said its own internal IT systems were not breached, production continued normally, and no sensitive personal data was stolen; it also reported that the incident did not create any safety risk and later indicated the situation was under control. The attackers were identified as the **Everest** group, which reportedly demanded **10 million Swiss francs** in ransom after the data theft. Stadler said it would not pay, filed a criminal complaint, and stated that no confirmed data loss had been established beyond the accessed supplier-platform information.
Jul 23, 2026
A ransomware attack hit facility maintenance systems at **Health Sciences Centre** in Winnipeg, disrupting building operations including **door access** and **heating, ventilation, and air conditioning (HVAC)** controls. Shared Health, which oversees the hospital, said **patient care and clinical operations continued uninterrupted** and that there was **no indication patients were affected**. The organization said the incident appeared limited to those systems and that no other hospital systems were known to be impacted. Shared Health said it launched an investigation into the nature and scope of the attack, notified the Manitoba government, and brought in expert assistance to respond. Reporting on the incident highlighted the growing risk ransomware poses to **operational technology** in healthcare environments, where attacks can disrupt physical infrastructure even when core clinical systems remain online. The attack also follows earlier warnings from Manitoba’s auditor general that Shared Health needed stronger cybersecurity testing and training to improve its readiness for cyber incidents.
Aug 13, 2026