NOTABLENATOB1incident

BravoX ransomware leaks 220 GB from a Vaud fiduciary, exposing ~15 municipalities' data and a cantonal minister's tax file

A breached Vaud accounting firm spilled 15 municipalities' administrative data; the fiduciary was the pivot, not any government network

first published 2026-07-24 04:36 UTC

Analysis

The extortion group BravoX, a Ransomware-as-a-Service operation first profiled on the RAMP underground forum in January 2026, which vets affiliates and by convention avoids CIS-based victims (SOCRadar, 2026-01-26), breached an accounting/fiduciary firm in Yverdon-les-Bains (canton Vaud) around 30 June 2026, and on 18 July published roughly 220 GB (over 100,000 files) on its Tor leak site (Le Temps, 2026-07-22). The firm's own account describes a "connection problem" to its server that led its IT provider to isolate affected systems, revoke compromised access and restore from an external backup; no negotiation took place and no ransom was paid (Le Temps, 2026-07-22). The leaked dataset spans individuals, businesses and institutions, and includes administrative and tax records of some fifteen Nord Vaudois municipalities (Corcelles-près-Concise and Belmont-sur-Yverdon among those named) and the personal tax file of Vaud State Councillor Vassilis Venizelos and his spouse (24 heures, 2026-07-23). The firm filed a criminal complaint and notified both the cantonal data-protection commissioner and the Federal Office for Cybersecurity (BACS/OFCS), Switzerland's mandatory critical-incident reporting channel (24 heures, 2026-07-23).

Defender takeaway

No government network was touched; the exposure of cantonal and municipal data ran entirely through a private supplier holding tax and administrative records on public administration's behalf. Swiss cantonal and municipal security teams should treat their outsourced fiduciary, accounting and payroll providers as in-scope for the personal and fiscal data those providers process, and confirm those firms carry incident-reporting obligations, tested offline backups (which limited this firm's operational impact) and data-protection notification duties in contract. The exposure is structural, not incidental: the municipal outsourcing model for fiduciary and accounting services concentrates cantonal and municipal personal and tax data inside private firms whose security posture the public bodies do not directly control.

Cited evidence

Le 18 juillet, quelque 220 Go de données y ont été publiées, soit plus de 100 000 dossiers.

Le Temps 2026-07-22

Aucune rançon n'a été versée. Une plainte pénale a été déposée et le préposé à la protection des données ainsi que l'Office fédéral de la cybersécurité ont été informés.

24 heures 2026-07-23

Sources4

Le Tempsprimary · 2026-07-22 24 heurescorroborating · 2026-07-23 20 minutes (CH)corroborating · 2026-07-23 SOCRadarcorroborating · 2026-01-26

PROVENANCE

AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.