CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Manno (TI) commune cyberattack, August 2026

incident · incident:manno-ti-commune-ransomware-2026-08 single-source

Cyberattack that encrypted data on part of the servers of the Ticino commune of Manno on 2026-08-04, restored from existing backups per the commune's notice of 2026-09-16; the ransomware group SafePay was recorded listing manno.ch on its leak site on 2026-09-28 (Comune di Manno; Ransomware.live).

Aliases: Manno commune attack

Coverage
1
first 2026-09-30 → last 2026-10-28
Latest activity
2026-10-28
Inside IT: SafePay published about 30 GB from Manno, social-assistance files with AHV numbers; no commune…
Peak priority
notable
1 notable
Targets
public-sector
sectors: public-sector · regions: switzerland
Sources cited
5
3 hosts

Defender insights

What each entry about Manno (TI) commune cyberattack, August 2026 tells a defender to do, newest first.

2026-09-30NOTABLEInside IT: SafePay published about 30 GB from Manno, social-assistance files with AHV numbers; no commune statement

Relationships explore in graph

Typed, source-stated connections from the entity registry; each edge cites the entry whose reporting establishes it.

related to

Story timeline

  1. 2026-09-30Swiss commune Manno (TI) confirms a cyberattack that encrypted part of its servers on 4 August 2026; SafePay has now published about 30 GB, which Risikomonitor reads as social-assistance decisions with AHV numbers, naturalisation files and a near-complete address book
    active-threatsInside IT: SafePay published about 30 GB from Manno, social-assistance files with AHV numbers; no commune statement

Hunting pivots

Tags
data-breachransomware
ATT&CK techniques (2 across 1 tactic)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.1 · compare on the matrix · Navigator layer (JSON)

  • ImpactData Encrypted for Impact · Financial Theft

Impact TA0040

T1486Data Encrypted for Impact×1

Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.

Evidence: 2026-09-30/manno-ti-commune-ransomware-safepay-claim · ATT&CK page ↗

T1657Financial Theft×1

Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own financial gain at the expense of the availability of these resources for victims. Financial theft is the ultimate objective of several popular campaign types including extortion by ransomware, business email compromise (BEC) and fraud, "pig butchering," bank hacking, and exploiting cryptocurrency networks.

Evidence: 2026-09-30/manno-ti-commune-ransomware-safepay-claim · ATT&CK page ↗

Entries about Manno (TI) commune cyberattack, August 2026 (1)

2026-09-30 · view entry permalink →

NOTABLEupdatedNATOB3

Swiss commune Manno (TI) confirms a cyberattack that encrypted part of its servers on 4 August 2026; SafePay has now published about 30 GB, which Risikomonitor reads as social-assistance decisions with AHV numbers, naturalisation files and a near-complete address book

The Ticino commune of Manno stated in a signed notice dated 2026-09-16 that on 4 August 2026 part of its servers suffered an attack that encrypted data (Comune di Manno, 2026-09-16). The commune isolated the affected server immediately and, per the notice, restored data and operations from existing backups in the course of the afternoon (Comune di Manno, 2026-09-16). It reported the case to the competent authorities, filed a criminal complaint against persons unknown, and told residents to distrust unexpected letters or e-mails that demand urgent payments or personal or financial data and to verify through official channels (Comune di Manno, 2026-09-16). The notice names no actor, no intrusion vector, and does not say whether data left the network; Inside IT's article of 2026-09-29 calls it a ransomware attack and says a backup allowed a quick return to normal operation (Inside IT, 2026-09-29).

On 2026-09-28, 55 days after the encryption, Ransomware.live recorded that the ransomware group SafePay had listed manno.ch on its leak site (Ransomware.live, 2026-09-28). Inside IT reported on 2026-10-27 that SafePay has put the stolen data into the darknet, about 30 GB in the case of Manno, and that the security firm Risikomonitor analysed it (Inside IT, 2026-10-27). Risikomonitor's reading, relayed by Inside IT and not verified independently: files with about 5,300 e-mail addresses and more than 2,000 identifiable persons; social-assistance decisions with name, address, monthly amount, AHV numbers and health insurer from 2014 to December 2025; debt-enforcement register extracts, naturalisation dossiers from 2018 and payment orders against tax debtors; employees' bank statements with IBANs; and mass letters, a youth-protection survey and a list of property owners with parcel and water-meter numbers that together give a near-complete address book of a commune of 1,381 inhabitants (Inside IT, 2026-10-27). Asked by Inside IT, the commune said it will make no statement on the publication (Inside IT, 2026-10-27).

on 4 August 2026 part of the commune's servers suffered an attack (translated from Italian)

which resulted in the encryption of the data (translated from Italian)

subsequently a complaint was lodged against (translated from Italian)

the population is urged to pay attention to unexpected communications (translated from Italian)

Comune di Manno (Municipio) 2026-09-16

Ransomware.live discovered on 2026-09-28 that manno.ch has been claimed by Safepay ransomware group

Ransomware.live

A ransomware gang attacked servers of the Manno municipal administration and encrypted part of the data (translated from German)

SafePay has put stolen data packages from these two attacks into the darknet, about 30 gigabytes in the case of Manno (translated from German)

documents on social-assistance decisions with name, address, monthly amount, AHV numbers and health insurer from 2014 to December 2025 (translated from German)

The municipality of Manno will not issue a statement in this matter. (translated from German)

Inside IT
Updaterun 2026-10-28T0256Z-inteltitleheadlinesummarytagstechniquessourcesevidenceverificationsourcing_noteclassificationbody

Inside IT reported on 2026-10-27 that SafePay has put the data stolen from Manno into the darknet, about 30 GB, and that the security firm Risikomonitor analysed it (Inside IT, 2026-10-27). Risikomonitor's analysis, relayed by Inside IT and not verified independently, finds files with about 5,300 e-mail addresses and more than 2,000 identifiable persons, social-assistance decisions with name, address, monthly amount, AHV numbers and health insurer from 2014 to December 2025, debt-enforcement extracts, naturalisation dossiers from 2018 and payment orders against tax debtors, and information on the whole population of 1,381 inhabitants (Inside IT, 2026-10-27). The commune told Inside IT it will make no statement. The claim as Inside IT reported it on 2026-09-29 named no dataset (Inside IT, 2026-09-29).

incident30 Sep 04:41Zsingle-sourceOpen finding →
Sources: Comune di Manno (Municipio) · Comune di Manno (Municipio), signed notice 'Avviso attacco informatico' · Ransomware.live (leak-site tracker, claim record) · Inside IT (article of 2026-09-29) · Inside IT (article of 2026-10-27, with Risikomonitor's analysis)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Threats1

Source distribution

  • inside-it.ch2 (40%)
  • manno.ch2 (40%)
  • ransomware.live1 (20%)
All cited sources (5)