RUAG LLC Akira ransomware incident and VBS ownership review

Swiss Defence Department closes its RUAG review: the Akira ransom payment broke no law, but the risk weighing and the owner notification were deficient — and the federal no-payment recommendation stands

The Swiss Defence Department published the result of its ownership review into RUAG MRO on 2026-08-04, covering the Akira ransomware attack on its US subsidiary RUAG LLC detected on 9 and 10 October 2025, in which data was stolen from the subsidiary's systems and a ransom was subsequently paid (VBS, 2026-08-04). The finding is the first written federal position on a Swiss state-owned company paying an extortion crew, and it separates two questions that are usually argued as one.

On legality, VBS concludes that RUAG MRO's decision to pay was taken within its own corporate responsibility and that there are no indications of a legal violation (VBS, 2026-08-04). The company checked the lawfulness of the payment under applicable US law before paying, and as a company organised under private law the decision sat with its own corporate bodies, requiring no prior consent from the Confederation as owner. SRF reports that RUAG leadership described the amount as small without naming a figure (SRF, 2026-08-04).

On governance, the department is critical. VBS assesses that political and reputational consequences, along with further overriding interests, were not sufficiently taken into account (VBS, 2026-08-04) — the weighing ran on legal and economic considerations alone. The second fault is sequencing: the Federal Council's strategic objectives for RUAG MRO require the owner to be informed before public communication, and that did not happen in a coordinated way. RUAG MRO's own post-incident analysis identified escalation processes at subsidiaries, IT governance including the role of the group IT lead, crisis-communication processes and minimum IT security requirements as the weak points, and is remediating them under reporting duties to the VBS general secretariat and the Federal Finance Administration. The Confederation as owner additionally directs RUAG MRO to review its protective measures with the Bundesamt für Cybersicherheit and have the overall adequacy of its cyber protection assessed. No further ownership-law measures follow.

The policy line is stated without ambiguity in the same document: VBS and the Confederation maintain their recommendation not to pay a ransom in the event of cyberattacks (VBS, 2026-08-04). A finding of lawfulness is not an endorsement, and the review says so.

Why this matters past RUAG. Three things transfer to any Swiss or European state-owned entity, cantonal utility or critical-infrastructure operator. First, the decision rights are now on the record: for a company under private law, paying is a corporate decision that does not require the owner's consent — while the owner's standing recommendation against it is reaffirmed in the same breath. Anyone drafting or reviewing a ransom-decision playbook now has a concrete precedent for how that tension resolves in practice, and for the fact that the reputational and political dimension is expected to appear in the decision record rather than only the legal and economic one. Second, the named failure mode is subsidiary escalation, not the encryption event: the incident happened at a foreign subsidiary, and the weaknesses the company itself identified are group-level escalation, governance and minimum security baselines that stopped at the parent's own perimeter. Group incident response that does not reach into subsidiaries is where this went wrong. Third, notification obligations turned out to be ordered rather than merely present — informing the owner before going public is a sequencing duty, and missing the order was itself a finding.