diakonissen-riehen.ch Listed by lockbit3 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 9 September 2022, the Swiss organisation diakonissen-riehen.ch appeared on the leak site operated by the LockBit3 ransomware group. Public reporting states that the group claims to have stolen internal data in a ransomware attack; the number of people affected remains unknown, and further technical detail has not been disclosed.

Listings of this kind signal that an organisation’s systems were allegedly compromised and that data may have been copied before encryption or publication threats were made. For anyone connected to diakonissen-riehen.ch—staff, patients, partners or donors—the listing is the clearest public indication so far that internal material may have left the organisation’s control.

Breaking down the breach

According to the available record, diakonissen-riehen.ch was listed by LockBit3 on or around 9 September 2022. The group’s claim is that internal files were exfiltrated during a ransomware attack. No confirmed figure for the volume of data, no list of specific file types beyond the general description “internal files,” and no public timeline of when the intrusion began or how long it lasted have been released in the material at hand.

Ransomware incidents typically involve unauthorised access, data theft, and the encryption of systems, followed by a demand or a threat to publish. In this case the public evidence consists of the leak-site listing itself and the accompanying claim of theft. Whether negotiations occurred, whether any ransom was paid, and whether the data were later released or sold are not stated in the reported facts. The scale of impact on individuals is likewise recorded as unknown.

The group behind it: lockbit3

LockBit3 is a well-documented ransomware operation that has appeared in numerous public incident reports since its earlier LockBit iterations. The group commonly operates a “ransomware-as-a-service” model: affiliates gain access to target networks, deploy the encryptor, and exfiltrate data, while the core operators maintain leak sites and payment infrastructure. Typical tactics include exploitation of exposed remote-access services, stolen credentials, and living-off-the-land techniques once inside a network, followed by double-extortion—threatening both operational disruption and public data release.

LockBit3 has previously listed organisations across healthcare, manufacturing, education and professional services. Its leak sites are used to pressure victims by naming them and, in many cases, by posting sample files. In the present matter the group claims to have stolen internal data from diakonissen-riehen.ch; that claim originates from the listing and has not been independently verified in the facts supplied here. No additional statements attributed to LockBit3 about this specific victim—such as sample file names, ransom amounts or deadlines—are contained in the record.

diakonissen-riehen.ch and its sector

Diakonissen-riehen.ch is the online presence of a diaconal (deaconess) institution based in Riehen, Switzerland. Organisations of this type traditionally combine Christian social service with practical care—historically nursing, elder care, community support and related pastoral or residential services. In the modern Swiss context such bodies often operate or support healthcare, nursing-home, outpatient or social-welfare activities and therefore handle administrative, clinical and personnel records.

Entities in the care and social-service sector routinely process names, contact details, dates of birth, health-related information, insurance identifiers, employment records and correspondence with families or referring agencies. A breach affecting such an organisation is consequential because the data are both sensitive and long-lived; individuals may remain linked to the institution for years through ongoing care or employment. Even when the precise contents of a theft remain unconfirmed, the sector’s data profile means any confirmed exfiltration carries elevated privacy and safety implications.

The information in question

The reported facts state only that “internal files” were exfiltrated in a ransomware attack. No inventory of document categories, no count of records, and no confirmation of whether health, financial or personnel data were among them have been published in the material available.

Organisations of this kind typically hold patient or resident files, staff personnel records, billing and insurance correspondence, internal administrative documents, and communications with external partners. It is reasonable to expect that some mixture of those categories could have been present on internal systems; however, the exact contents taken in this incident remain unconfirmed. Readers should treat any assertion of specific data types beyond the stated “internal files” as unverified unless corroborated by the organisation or by independent forensic disclosure.

Why it matters

For affected individuals the practical risks include unwanted contact, identity misuse, or the exposure of private health or personal circumstances. Even limited internal documents can contain enough identifying detail to enable phishing or social-engineering attempts that appear legitimate because they reference real names, dates or case details. For staff, leaked personnel material can create lasting privacy and employment-related concerns.

For the organisation the consequences include operational disruption during containment and recovery, potential regulatory scrutiny under Swiss data-protection rules, reputational damage, and the cost of notification, support and system hardening. Because the number of people affected is unknown, the full scope of these effects cannot yet be measured. The absence of public confirmation about what was taken does not remove the underlying risk; it simply means that individuals and the institution must proceed on the basis of incomplete information.

Were you affected?

If you have had any relationship with diakonissen-riehen.ch—as a patient, resident, family member, employee or contractor—consider practical steps. Monitor account statements and insurance correspondence for unfamiliar activity. Treat unsolicited messages that reference the organisation or your personal details with caution; verify directly through known official channels rather than links or numbers supplied in the message. If you are a current or former staff member, ask the organisation’s designated contact point whether notification procedures apply to you and whether credit or identity-monitoring support is being offered.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets. That check will not confirm or rule out involvement in this specific incident, but it can indicate whether your address is circulating more widely and help you prioritise password changes and multi-factor authentication on important accounts. Keep records of any suspicious contact and report clear evidence of misuse to the appropriate Swiss authorities.

AICompiled with AI assistance from public sources and published under our editorial standards.