Groupe 3R ransomware breach

Groupe 3R (Réseau Radiologique Romand): Akira ransomware attack on 20 Swiss imaging centres, administrative data stolen and published, medical data encrypted

Groupe 3R (Réseau Radiologique Romand), which runs 20 medical-imaging centres in seven Swiss cantons (ICTjournal.ch, 2026-05-06), lists its centres in Vaud, Valais, Fribourg, Geneva, Neuchâtel, Berne and Zurich (Groupe 3R). It was hit on Thursday 2026-04-30 by a ransomware attack with data encryption; patient care was affected above all on 1 and 2 May, all centres stayed open, the attack was reported to the Federal Office for Cybersecurity, a criminal complaint was filed and no ransom will be paid (Groupe 3R). Akira listed the operator on its leak site, where ransomware.live recorded it on 2026-05-08 with an estimated attack date of 2026-04-30 (ransomware.live, 2026-05-08), announcing it would upload 48 GB of corporate data including employee identity documents, patient information, payment details and NDAs (DeXpose, 2026-05-09).

Groupe 3R now states that administrative data, including personal information of current and former employees, was encrypted and stolen, that medical data (exam results) was encrypted and made unusable, and that it is not possible to say with certainty whether patient medical data was also stolen (Groupe 3R). It acknowledged that internal documents stolen in the attack were published on the darknet, and attributes the attack to Akira because the gang's methods match what its specialist cybersecurity partners observed (ICTjournal.ch, 2026-07-06). This is its second attack in about a year: in April 2025 attackers stole medical and administrative data without disrupting operations (SwissCybersecurity.net, 2026-05-07), and Groupe 3R says the two attacks have different perpetrators and methods (Groupe 3R). Since 2026-06-26 all centres run on a rebuilt IT infrastructure with RIS, PACS, telephony and teleradiology restored, although some past examination data was still inaccessible in the operator's update of 2026-09-22 (Groupe 3R). No source states how the attackers got in; CISA's Akira advisory describes initial access mostly through VPN services using known CVEs, and encryption that is full or partial depending on file type and size (CISA AA24-109A).