CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

BravoX breach of a Yverdon-les-Bains fiduciary, Vaud municipalities data exposure

incident · incident:bravox-yverdon-fiduciary-vaud-municipalities-2026

BravoX's June 2026 ransomware breach of an Yverdon-les-Bains (canton Vaud) fiduciary/accounting firm, leaked 18 July 2026: ~220 GB / 100,000+ files including administrative and tax records of ~15 Nord Vaudois municipalities and Vaud State Councillor Vassilis Venizelos's tax file. No ransom paid; reported to the cantonal data-protection commissioner and the Federal Office for Cybersecurity (BACS/OFCS) (Le Temps / 24 heures / 20 minutes, 2026-07-22/23).

Coverage
1
first 2026-07-24 → last 2026-07-24
Latest activity
2026-07-24
A breached Vaud accounting firm spilled 15 municipalities' administrative data; the fiduciary was the pivot…
Peak priority
notable
1 notable
Targets
public-sector
sectors: public-sector, legal-services · regions: switzerland, europe
Sources cited
4
4 hosts

Defender insights

What each entry about BravoX breach of a Yverdon-les-Bains fiduciary, Vaud municipalities data exposure tells a defender to do, newest first.

2026-07-24NOTABLEA breached Vaud accounting firm spilled 15 municipalities' administrative data; the fiduciary was the pivot, not any government network

Relationships explore in graph

Typed, source-stated connections from the entity registry; each edge cites the entry whose reporting establishes it.

attributed to

Story timeline

  1. 2026-07-24BravoX ransomware leaks 220 GB from a Vaud fiduciary, exposing ~15 municipalities' data and a cantonal minister's tax file
    active-threatsA breached Vaud accounting firm spilled 15 municipalities' administrative data; the fiduciary was the pivot, not any government network

Hunting pivots

Tags
data-breachorganized-crimeransomware
ATT&CK techniques (2 across 1 tactic)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • ImpactData Encrypted for Impact · Financial Theft

Impact TA0040

T1486Data Encrypted for Impact×1

Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.

Evidence: 2026-07-24/bravox-vaud-fiduciary-municipalities-breach · ATT&CK page ↗

T1657Financial Theft×1

Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own financial gain at the expense of the availability of these resources for victims. Financial theft is the ultimate objective of several popular campaign types including extortion by ransomware, business email compromise (BEC) and fraud, "pig butchering," bank hacking, and exploiting cryptocurrency networks.

Evidence: 2026-07-24/bravox-vaud-fiduciary-municipalities-breach · ATT&CK page ↗

Entries about BravoX breach of a Yverdon-les-Bains fiduciary, Vaud municipalities data exposure (1)

2026-07-24 · view entry permalink →

NOTABLENATOB1

BravoX ransomware leaks 220 GB from a Vaud fiduciary, exposing ~15 municipalities' data and a cantonal minister's tax file

The extortion group BravoX, a Ransomware-as-a-Service operation first profiled on the RAMP underground forum in January 2026, which vets affiliates and by convention avoids CIS-based victims (SOCRadar, 2026-01-26), breached an accounting/fiduciary firm in Yverdon-les-Bains (canton Vaud) around 30 June 2026, and on 18 July published roughly 220 GB (over 100,000 files) on its Tor leak site (Le Temps, 2026-07-22). The firm's own account describes a "connection problem" to its server that led its IT provider to isolate affected systems, revoke compromised access and restore from an external backup; no negotiation took place and no ransom was paid (Le Temps, 2026-07-22). The leaked dataset spans individuals, businesses and institutions, and includes administrative and tax records of some fifteen Nord Vaudois municipalities (Corcelles-près-Concise and Belmont-sur-Yverdon among those named) and the personal tax file of Vaud State Councillor Vassilis Venizelos and his spouse (24 heures, 2026-07-23). The firm filed a criminal complaint and notified both the cantonal data-protection commissioner and the Federal Office for Cybersecurity (BACS/OFCS), Switzerland's mandatory critical-incident reporting channel (24 heures, 2026-07-23).

Le 18 juillet, quelque 220 Go de données y ont été publiées, soit plus de 100 000 dossiers.

Le Temps 2026-07-22

Aucune rançon n'a été versée. Une plainte pénale a été déposée et le préposé à la protection des données ainsi que l'Office fédéral de la cybersécurité ont été informés.

24 heures 2026-07-23
incident24 Jul 04:36Zmulti-sourceOpen finding →
Sources: Le Temps · 24 heures · 20 minutes (CH) · SOCRadar

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Threats1

Source distribution

  • 20min.ch1 (25%)
  • 24heures.ch1 (25%)
  • letemps.ch1 (25%)
  • socradar.io1 (25%)
All cited sources (4)