Swiss commune Manno (TI) confirms a cyberattack that encrypted part of its servers on 4 August 2026; SafePay has now published about 30 GB, which Risikomonitor reads as social-assistance decisions with AHV numbers, naturalisation files and a near-complete address book
Inside IT: SafePay published about 30 GB from Manno, social-assistance files with AHV numbers; no commune statement
Analysis
The Ticino commune of Manno stated in a signed notice dated 2026-09-16 that on 4 August 2026 part of its servers suffered an attack that encrypted data (Comune di Manno, 2026-09-16). The commune isolated the affected server immediately and, per the notice, restored data and operations from existing backups in the course of the afternoon (Comune di Manno, 2026-09-16). It reported the case to the competent authorities, filed a criminal complaint against persons unknown, and told residents to distrust unexpected letters or e-mails that demand urgent payments or personal or financial data and to verify through official channels (Comune di Manno, 2026-09-16). The notice names no actor, no intrusion vector, and does not say whether data left the network; Inside IT's article of 2026-09-29 calls it a ransomware attack and says a backup allowed a quick return to normal operation (Inside IT, 2026-09-29).
On 2026-09-28, 55 days after the encryption, Ransomware.live recorded that the ransomware group SafePay had listed manno.ch on its leak site (Ransomware.live, 2026-09-28). Inside IT reported on 2026-10-27 that SafePay has put the stolen data into the darknet, about 30 GB in the case of Manno, and that the security firm Risikomonitor analysed it (Inside IT, 2026-10-27). Risikomonitor's reading, relayed by Inside IT and not verified independently: files with about 5,300 e-mail addresses and more than 2,000 identifiable persons; social-assistance decisions with name, address, monthly amount, AHV numbers and health insurer from 2014 to December 2025; debt-enforcement register extracts, naturalisation dossiers from 2018 and payment orders against tax debtors; employees' bank statements with IBANs; and mass letters, a youth-protection survey and a list of property owners with parcel and water-meter numbers that together give a near-complete address book of a commune of 1,381 inhabitants (Inside IT, 2026-10-27). Asked by Inside IT, the commune said it will make no statement on the publication (Inside IT, 2026-10-27).
Cited evidence
on 4 August 2026 part of the commune's servers suffered an attack (translated from Italian)
which resulted in the encryption of the data (translated from Italian)
subsequently a complaint was lodged against (translated from Italian)
the population is urged to pay attention to unexpected communications (translated from Italian)
Ransomware.live discovered on 2026-09-28 that manno.ch has been claimed by Safepay ransomware group
A ransomware gang attacked servers of the Manno municipal administration and encrypted part of the data (translated from German)
SafePay has put stolen data packages from these two attacks into the darknet, about 30 gigabytes in the case of Manno (translated from German)
documents on social-assistance decisions with name, address, monthly amount, AHV numbers and health insurer from 2014 to December 2025 (translated from German)
The municipality of Manno will not issue a statement in this matter. (translated from German)
Updates1
Inside IT reported on 2026-10-27 that SafePay has put the data stolen from Manno into the darknet, about 30 GB, and that the security firm Risikomonitor analysed it (Inside IT, 2026-10-27). Risikomonitor's analysis, relayed by Inside IT and not verified independently, finds files with about 5,300 e-mail addresses and more than 2,000 identifiable persons, social-assistance decisions with name, address, monthly amount, AHV numbers and health insurer from 2014 to December 2025, debt-enforcement extracts, naturalisation dossiers from 2018 and payment orders against tax debtors, and information on the whole population of 1,381 inhabitants (Inside IT, 2026-10-27). The commune told Inside IT it will make no statement. The claim as Inside IT reported it on 2026-09-29 named no dataset (Inside IT, 2026-09-29).
Sources5
Revision history
- Published 2026-09-30T0404Z-intel
- Update 2026-10-28T0256Z-intel
Inside IT reported on 2026-10-27 that SafePay has put about 30 GB of data stolen from Manno into the darknet and relays Risikomonitor's analysis of its contents (social-assistance decisions with AHV numbers, debt-enforcement and naturalisation files, a near-complete address book); the commune will make no statement. This replaces the entry's statement that the listing described no data and could not be corroborated.
Changed: title headline summary tags techniques sources evidence verification sourcing_note classification body
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.