Walder Wyss and Partners Listed by play Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 12 June 2024, the Swiss organisation Walder Wyss and Partners was listed by the ransomware group known as play. Public reporting indicates that internal files were exfiltrated in a ransomware attack, though the number of people affected remains unknown and further operational details have not been disclosed.

The listing places the firm among victims claimed by play. For clients, staff and counterparties who may have shared information with the firm, the incident raises practical questions about what data left its systems and what steps are available while official confirmation and full scope remain limited.

What happened

According to the available record, Walder Wyss and Partners was listed by the play ransomware group on 12 June 2024. The reported summary associates the organisation with Switzerland. The facts state that internal files were exfiltrated in a ransomware attack. No public figure has been given for the number of people affected, and details such as the precise date of intrusion, the initial access method, the volume of data taken, or any ransom demand are undisclosed. The listing itself is a claim published by the group; independent confirmation of the full extent of the incident has not been supplied in the material reviewed here.

The group behind it: play

Play is a ransomware operation that has been active in public reporting for several years. Like many contemporary groups, it is associated with double-extortion tactics: encrypting systems while also copying data and threatening to publish or sell it if payment is not made. The group maintains a leak site on which it posts victim names and, in some cases, samples or larger archives of stolen material. Play has previously claimed attacks against organisations across multiple sectors and countries. In this instance the group claims Walder Wyss and Partners as a victim and asserts that internal files were taken; no additional statements specific to this firm beyond the listing and the description of exfiltrated internal files appear in the given facts.

Walder Wyss and Partners and its sector

Walder Wyss and Partners is a Swiss professional-services firm operating in the legal sector. Law firms of this type routinely handle confidential client matters, contracts, correspondence, financial records, personal identification data and privileged legal advice. Because the work involves regulated professions and cross-border clients, the data held is often sensitive both commercially and personally. A ransomware incident that includes data exfiltration therefore carries consequences beyond operational disruption: it can expose third-party information entrusted to the firm and create regulatory and reputational exposure under Swiss and European data-protection rules. Public detail on the firm’s internal response or any notifications it has issued remains limited in the material available for this account.

The information in question

The facts name the exposed material only as “internal files exfiltrated in a ransomware attack.” No further breakdown of file types, client names, document categories or volume has been provided. Organisations in the legal sector typically hold client identity documents, case files, emails, billing records, contracts and internal memoranda. Whether any of those categories were among the files taken in this incident is unconfirmed. Readers should treat the precise contents as undisclosed until the firm or competent authorities publish verified inventories.

Why it matters

For individuals whose data may have been held by the firm, the principal risks are misuse of personal or financial information, targeted phishing that references genuine case details, and longer-term identity or privacy harm if documents surface publicly. For the organisation itself, the consequences include potential regulatory scrutiny, client notification duties, possible civil claims, and the operational cost of investigation and recovery. Because the number of people affected is unknown and the exact data set is unconfirmed, the scale of these risks cannot yet be quantified. The incident nevertheless illustrates the exposure that arises when professional-service firms become targets of ransomware groups that combine encryption with data theft.

Were you affected?

If you have been a client, employee or counterpart of Walder Wyss and Partners, treat the possibility of exposure seriously while recognising that public confirmation of individual records is still absent. Practical first steps include:

• Monitor bank, credit and email accounts for unexpected activity or messages that reference the firm or your legal matters.
• Enable multi-factor authentication on important accounts and change passwords that may have been reused.
• Be cautious of unsolicited calls or emails claiming to relate to this incident; verify any request through known official channels.
• Retain copies of any formal notification you later receive from the firm or from data-protection authorities.
• Run a free exposure scan of your email address against known breach data sets to check whether your information has already appeared in public or traded collections.

Further verified information, if released by the firm or Swiss authorities, should be the primary source for deciding additional protective measures.

AICompiled with AI assistance from public sources and published under our editorial standards.