Dyhrberg AG Switzerland Listed by Deadlock Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

What happened

The incident centers on a ransomware operation that targeted Dyhrberg AG Switzerland. Public reporting indicates that files were removed from the organisation’s systems prior to or during encryption. The precise date of the intrusion, the volume of data taken, and the method of initial access have not been disclosed. The group’s listing constitutes its claim of responsibility; independent confirmation of the data’s contents or the attack’s full scope has not been made public.

The group behind it: Deadlock

Deadlock is a ransomware operator that follows a double-extortion model. It typically encrypts victim systems while also copying files for later publication or sale if a ransom demand is not met. The group maintains a leak site where it lists organisations it claims to have compromised. Its activity has been documented across multiple sectors in public threat-intelligence reporting, with listings often appearing shortly after an attack becomes known to the operators. In this case the group asserts that Dyhrberg AG Switzerland was among its targets; that assertion has not been independently verified beyond the listing itself.

Dyhrberg AG Switzerland and its sector

Dyhrberg AG Switzerland is a Swiss-registered company operating under the Aktiengesellschaft corporate form. Swiss companies of this type routinely maintain records related to contracts, personnel, financial transactions, and operational processes. A breach involving internal files from such an entity can therefore touch on information that is normally kept confidential for commercial or regulatory reasons. The exact nature of Dyhrberg AG’s business activities is not detailed in available breach reporting.

What was likely exposed

The only data category named in connection with the incident is internal files exfiltrated during the ransomware attack. No inventory of specific file types, record counts, or data fields has been released. Organisations of this kind commonly store documents that include employee records, client correspondence, and administrative materials, yet the precise contents removed in this case remain unconfirmed.

• Internal files were reported as exfiltrated
• No confirmed data categories beyond that description
• Number of individuals affected is unknown

Why it matters

Internal files can contain details that, if disclosed, may affect individuals whose information appears in corporate records or may expose operational information that organisations prefer to keep private. For the company, the incident adds the costs of investigation, potential regulatory notification under Swiss data-protection rules, and any remediation steps required after a ransomware event. The absence of a confirmed data inventory means the full extent of downstream consequences cannot yet be assessed.

If your data was in this claimed breach

Individuals who believe their information may have been held by Dyhrberg AG Switzerland should monitor their financial and email accounts for unusual activity. Enabling multi-factor authentication on important services and changing passwords for any accounts that reuse credentials are standard first measures. Readers may also run a free exposure scan of their email address against known breach data sets to check for prior appearances of their information.

AICompiled with AI assistance from public sources and published under our editorial standards.