Loading story…
Swiss public broadcaster SRG SSR disclosed a cybersecurity incident involving unauthorized access to personal data of employees at its SRF subsidiary. The organization said it disabled the affected access route, deployed additional security measures, and launched an investigation with internal and external specialists.
SRG SSR notified relevant authorities, filed a criminal complaint, and directly informed affected individuals. The broadcaster did not identify the responsible threat actor, initial intrusion method, number of affected records, or indicators of compromise.
See attribution, scope, and your downstream exposure.
1 event from the most recent confirmed update back to the earliest known activity.
SRG SSR announced that unauthorized parties accessed personal data belonging to employees of its SRF subsidiary. The broadcaster disabled the compromised access, added security measures, opened an investigation with internal and external experts, notified authorities, filed a criminal complaint, and informed affected individuals.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
RSA disclosed that attackers carried out an **advanced persistent threat** intrusion against its internal systems and stole information related to its **SecurID** two-factor authentication products. EMC said the compromise did not appear to expose customer or employee personally identifiable information, other RSA products, or other EMC products, but warned that the stolen data could reduce the effectiveness of existing SecurID deployments if used as part of a broader attack. The company said it notified customers, worked with authorities, hardened affected systems, and issued guidance through SecurCare Online to help organizations strengthen their SecurID implementations. RSA later described the intrusion as a targeted spear-phishing campaign in which employees received emails with the subject **"2011 Recruitment Plan"** and an attached Excel file that exploited the Adobe Flash zero-day **`CVE-2011-0609`** to install a backdoor and a customized **Poison Ivy** remote access trojan. The attackers harvested credentials, escalated privileges, moved laterally, staged data internally, and exfiltrated it via FTP in password-protected RAR archives to an external compromised host. EMC said the breach ultimately cost at least **$66.3 million** for investigation, infrastructure hardening, customer monitoring, and replacement of some SecurID tokens, and later reporting linked the stolen information to follow-on targeting, including an attempted attack on Lockheed Martin.
Jun 29, 2026
Cookeville Regional Medical Center in Tennessee disclosed that a ransomware attack tied to the **Rhysida** gang exposed the personal, financial, and protected health information of **337,917 individuals**. The hospital said an unauthorized party accessed its network between **July 11 and July 14, 2025**, and a forensic investigation later determined that files may have been viewed or stolen during that period. Exposed data varied by individual and could include names, addresses, dates of birth, Social Security numbers, driver’s license numbers, financial account details, medical information, medical record numbers, and health insurance information. Rhysida claimed responsibility for the intrusion, saying it exfiltrated about **538 GB** of data and later listed the medical center on its dark web leak site, where it said **70%** of the data had been leaked. The breach was initially reported to HHS with a placeholder figure before a full file review was completed in March 2026, after which the hospital began broader notifications. Cookeville Regional said it has not found evidence of misuse so far, urged affected people to monitor accounts and explanation-of-benefits statements, and offered **12 months** of credit monitoring and identity theft protection.
Jun 29, 2026
Stiftung Wagerenhof in Uster, Zurich, disclosed that a ransomware attack hit its virtual IT environment, blocking access to multiple systems and encrypting data. The attackers later issued a ransom demand after the intrusion, disrupting the foundation’s operations and prompting the organization to publish ongoing public updates about the incident. The foundation said it shut down all systems and connections immediately after detecting the attack and brought in external ICT and cybersecurity specialists to support containment and recovery. Cantonal police were involved, the incident was reported to Switzerland’s Federal Office for Cybersecurity (**BACS**), and a criminal complaint was filed; Wagerenhof also said it would not pay the ransom.
Jul 23, 2026