ARA-Region Lyss-Limpachtal (canton Bern, communal wastewater-treatment association): SafePay has put about 49 GB into the darknet, which Risikomonitor's analysis, relayed by Inside IT, finds holds personal records, bank statements, weak passwords and a third party's monitoring credentials; the association declines to comment

The tracker DeXpose recorded on 2026-09-15 that SafePay had claimed an attack on ARA Lyss, the wastewater-treatment association at ara-lyss.ch, posting that the full leak would be published soon unless a company representative made contact (DeXpose, 2026-09-15). Inside IT reported on 2026-10-27 that SafePay has put the stolen data into the darknet, about 49 GB in the case of the Bernese association ARA-Region Lyss-Limpachtal, that the security firm Risikomonitor analysed it, and that the association's management declined to comment (Inside IT, 2026-10-27). Risikomonitor's analysis, relayed by Inside IT and not verified independently, finds about 3,200 e-mail addresses and data on more than 1,200 identifiable persons; user folders and a data store with content up to March 2026 that hold 255 password hits, 195 of them very weak; bank statements and a transaction list with more than 100 payments by private persons with name and address; the full login data to the monitoring portals of the photovoltaic plants of another company's customers, stored on the same server; and a 2015 applicant list with birth dates, civil status, former employer and interview notes that was never deleted (Inside IT, 2026-10-27).

BACS told Inside IT that SafePay, which relies on double extortion, is among the more active ransomware groups in Switzerland and, together with The Gentlemen, the third most active in 2026 after Akira and Payload, that it has no clear focus on Switzerland, and that it was first observed there in May 2025 (Inside IT, 2026-10-27). No source says how the attackers got in or that data was encrypted at the association.