Choice AG Listed by crypto24 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target financial-services and investment firms, where sensitive internal records and client-related material can be leveraged for extortion. In this environment, the appearance of a company on a threat actor’s leak site is often the first public signal that data may have been taken.

On 29 May 2025, Choice AG, a Switzerland-based provider of investment and risk-management solutions, was listed by the ransomware group crypto24. Public reporting states that internal files were exfiltrated in a ransomware attack; the number of people affected remains unknown and further technical detail has not been disclosed. The listing itself is a claim by the group and has not been independently confirmed in the available record.

Breaking down the breach

According to the reported information, Choice AG was listed by crypto24 on 29 May 2025. The only data category named is “internal files” said to have been exfiltrated during a ransomware attack. No public figure has been given for the volume of data, the number of systems involved, or the precise date the intrusion began. Method of initial access, encryption status of systems, and any ransom demand are undisclosed. The people-affected count is listed as unknown. In short, the public record consists of the group’s claim that it obtained and removed internal files, together with the date the listing was reported.

Who is crypto24?

crypto24 is a ransomware operation that follows the now-common double-extortion model: data is stolen before systems are encrypted, and victims are threatened with public release if payment is not made. The group maintains a leak site on which it posts the names of organisations it claims to have compromised, often accompanied by sample files or countdown timers. Like other actors in this category, crypto24 has previously targeted a range of sectors, using the threat of data publication to increase pressure. Its listing of Choice AG should be treated as an unverified claim unless and until the company or independent investigators state the intrusion and the scope of any data removal.

Who is Choice AG?

Choice AG is a Switzerland-based firm that supplies software and services for investment and risk management. Its offerings include portfolio-management tools, risk-analysis platforms and asset-management support aimed at both institutional and private investors. The company works with a variety of asset classes, from bonds to real estate. Organisations of this type routinely handle proprietary investment models, client portfolios, risk assessments, contractual documents and internal operational records. A breach at such a firm therefore raises concerns not only for the company itself but also for the investors and counterparties whose information may appear in those internal files.

What was likely exposed

The only category explicitly named in the available facts is “internal files” exfiltrated in a ransomware attack. No inventory of file types, databases or personal-data fields has been published. Firms that provide investment and risk-management services typically maintain documents such as portfolio holdings, risk reports, client correspondence, contracts, employee records and proprietary analytical models. Whether any of those categories were among the files allegedly taken from Choice AG remains unconfirmed. Until the company or a competent authority releases a verified description, the exact contents of the exfiltrated material cannot be stated as fact.

What's at stake

For individuals whose data may have been present in the internal files, the practical risks include identity misuse, targeted phishing that references genuine investment or risk details, and potential exposure of financial positions. For Choice AG the consequences can include regulatory scrutiny under Swiss and European data-protection rules, contractual obligations to notify clients, reputational damage, and the operational cost of investigation and remediation. Because the scale of the incident and the precise data types remain unknown, the full extent of these risks cannot yet be quantified. The absence of a confirmed headcount of affected people further complicates notification and support efforts.

Were you affected?

If you are a client, employee or partner of Choice AG, monitor official statements from the company for any confirmation of the incident and guidance on next steps. Watch for unexpected communications that reference investment accounts, risk reports or personal details that could have been drawn from internal files. Consider placing fraud alerts with credit-monitoring services where appropriate, and change passwords on any related accounts. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets; such a scan does not prove involvement in this specific incident but can surface earlier exposures that warrant attention.

AICompiled with AI assistance from public sources and published under our editorial standards.