Swiss Defense Contractor Ruag Allowed to Pay Akira Ransom

The state‑owned Swiss defence firm Ruag paid a ransom to the Akira ransomware group after a cyber‑attack on its US subsidiary in Virginia in autumn 2025. The attackers stole data and threatened to publish it on the dark web unless a payment was made.

Switzerland’s Department of Defence, Population Protection and Sport (VBS) reviewed the incident and concluded that the payment complied with US law and did not constitute a legal violation. Because Ruag is a privately‑held joint‑stock company, the department said no separate approval from the federal owner was required. The VBS report, however, criticised the lack of coordinated information with the federal authorities and noted that political and reputational consequences were not fully taken into account. As a result, Ruag will work with the Federal Office for Cybersecurity to review and strengthen its cyber‑defence measures.