cornu.ch Listed by lockbit3 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 20 June 2023, the Swiss organisation cornu.ch appeared on a leak site operated by the ransomware group lockbit3. The listing claims that internal files were taken in a ransomware attack. How many people may be affected remains unknown, and public detail on the precise contents of those files is limited. For anyone who has dealt with the company—customers, staff, suppliers or partners—the practical question is straightforward: whether personal or business information was among the material copied, and what that could mean for privacy, fraud risk or further misuse.

Ransomware incidents of this type typically combine encryption of systems with the theft of data, followed by pressure to pay. Even when the full scope stays undisclosed, the mere claim of exfiltration is enough to warrant attention from those whose details might sit in internal records.

Inside the incident

Public reporting on the incident is sparse. What is known is that cornu.ch was listed by lockbit3 on 20 June 2023, with the group asserting that internal files had been exfiltrated during a ransomware attack. No confirmed figure for the number of people affected has been released. The method of initial access, the duration of any intrusion, whether systems were encrypted as well as copied, and whether a ransom demand was issued or paid are all undisclosed in the available record.

The organisation’s own public description frames it as a gourmet destination offering an interactive museum, factory shop and café. Beyond the leak-site claim itself, no further technical indicators, file counts or sample data have been detailed in the facts at hand. In short, the incident is documented principally as a listing alleging theft of internal files; everything else remains unconfirmed.

The group behind it: lockbit3

Lockbit3 is the name associated with a long-running ransomware operation that has appeared frequently in public reporting. The group functions as a ransomware-as-a-service model: affiliates gain access to victim networks, deploy the encryptor, and share proceeds with the core operators. A hallmark of its activity is double extortion—copying data before encryption and threatening to publish it on a dedicated leak site if payment is not made.

Lockbit3 and its predecessors have claimed responsibility for attacks across many sectors and countries. Listings on its site are assertions by the group; they are not independent confirmation that every claimed file set was in fact taken or that every named organisation suffered the full impact described. In this case, the facts record only that cornu.ch was listed and that the group claims internal files were exfiltrated. No additional statements attributed to lockbit3 about this specific victim appear in the given record.

Who is cornu.ch?

Cornu.ch presents itself as a Swiss gourmet enterprise centred on food production and visitor experiences. Its public materials invite people into an “interactive museum,” a factory shop and an on-site café—typical of companies that combine manufacturing, retail and tourism. Organisations of this kind ordinarily maintain records covering customers (orders, loyalty or contact details), employees (HR and payroll), suppliers, and internal operational documents.

A breach involving such an entity matters because the data held is rarely limited to one category. Visitor bookings, purchase histories, staff information and commercial contracts can all sit in the same environment. When a ransomware group claims to have taken internal files, the potential reach therefore extends beyond a single department to anyone whose details were stored for ordinary business reasons. The Swiss setting also brings data-protection expectations under national and European frameworks, raising the stakes for both the organisation and the individuals concerned.

What data was at risk

The facts state that internal files were exfiltrated in a ransomware attack. No further breakdown—such as customer databases, employee records, financial documents or specific file names—has been disclosed. Exact contents therefore remain unconfirmed.

Companies operating museums, factory shops and cafés commonly hold names, addresses, email addresses, phone numbers, payment or order information, employment data and internal correspondence. It is reasonable to expect that some mixture of these categories could have been present on the affected systems, yet it would be inaccurate to treat any particular type as verified. Until the organisation or independent analysis provides a clearer inventory, the prudent position is that internal material of unspecified scope was claimed to have been taken.

What's at stake

For individuals, the concrete risks are familiar but real. If contact or identity details were included, phishing and social-engineering attempts may increase. If financial or order data were present, monitoring for fraud becomes advisable. Employees face possible exposure of personnel information. Suppliers and partners may see commercial terms or correspondence surface.

For the organisation the consequences include operational disruption, regulatory notification duties, reputational harm and the cost of investigation and remediation. Because the number of people affected is unknown and the precise data types are not listed beyond “internal files,” the full scale of harm cannot yet be measured. The following points summarise the practical exposure:

• Unknown number of individuals potentially involved
• Claimed exfiltration of internal files only; no public catalogue of contents
• Possible secondary risks of phishing, fraud or identity misuse if personal data were among the material
• Organisational obligations around notification and response under applicable data-protection rules
• No public confirmation of whether systems were also encrypted or whether any ransom was paid

Were you affected?

If you have been a customer, visitor, employee or supplier of cornu.ch, treat the listing as a signal to stay alert rather than as proof that your own data was taken. Review bank and card statements for unfamiliar charges, be cautious of unexpected emails or calls that reference the company, and consider changing passwords if you ever reused credentials on related accounts. You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets. Official updates, if any are issued by the organisation, remain the primary source for confirmed scope; until then, measured vigilance is the most useful response.

AICompiled with AI assistance from public sources and published under our editorial standards.