The Berlin government ransomware case is a useful warning for Swiss cantons and municipalities because it exposes the full shape of a public-sector crisis. When stolen data is published after an attack, the incident is no longer only an outage. It becomes a confidentiality event, a service-continuity problem, a legal assessment and a test of public trust. The same pressure applies to Swiss authorities that operate with limited specialist capacity and depend on shared providers.
Public institutions cannot choose their recovery priorities solely by technical convenience. A payroll system, identity service, emergency workflow and citizen portal may have different owners, suppliers and tolerances for downtime. The response plan must connect those dependencies before an attacker forces decisions under pressure.
Double extortion is a public-service crisis
Ransomware operators use encryption to create visible disruption and data theft to create a second source of leverage. Publication threats can expose case files, employee records, procurement documents and correspondence even when the most critical systems are restored. A municipality that focuses only on bringing servers back online may therefore miss the harm created by data disclosure.
Swiss authorities should classify likely data exposure early, without treating an attacker’s claim as proof. Separate confirmed access, plausible exposure and unverified allegations. That distinction supports proportionate communication and avoids repeating sensitive details unnecessarily. It also gives the data-protection lead a basis for deciding whether notification and engagement with relevant authorities are required.
Data minimisation is an operational control in this context. The less sensitive information retained in broadly accessible shares, email archives and legacy applications, the smaller the blast radius when an account or server is compromised. Retention reviews are therefore part of ransomware readiness, not an administrative exercise performed after recovery.
◆ Key Takeaway
A public-sector ransomware plan must assume that service disruption and data disclosure will compete for attention. Recovery, privacy assessment and public communication should run as coordinated workstreams from the first hour.
Design recovery around citizens and safety
Start with essential services, not the list of servers. Each canton and municipality should define the minimum viable process for public safety, social services, payments, identity, records and communications. For every process, document a manual fallback, a responsible decision-maker, the trusted data source and the maximum tolerable interruption.
Recovery order should be tested with dependencies. Restoring an application without its identity provider, network segment or authoritative data may create a fragile appearance of normality. Isolated restoration environments, separate backup credentials and clean administrative workstations reduce the chance of reintroducing the attacker while systems are brought back.
Shared services require shared exercises. A cantonal provider, municipal IT unit and external software supplier may each hold only part of the recovery picture. Contracts should specify who preserves logs, who can authorise isolation, how evidence is shared and which party communicates with affected users. These provisions are especially important when several municipalities rely on the same platform.
Communicate without amplifying harm
Residents need useful facts: which services are unavailable, what alternative channel is safe, whether deadlines are extended and when the next update will arrive. They do not need a speculative attack narrative or a link to stolen material. Establish one verified public page and a trusted telephone route, and assume that normal email may be unreliable during the opening phase.
Employees need equally clear instructions. Tell them which devices and accounts to stop using, how to report suspicious messages and where to obtain approved updates. A crisis team should monitor impersonation attempts because attackers may use the incident to target staff, suppliers and citizens with convincing follow-up fraud.
Internal records matter. Keep a decision log showing when systems were isolated, what evidence was preserved, which services were restored and why public statements changed. The chronology supports legal review, insurer discussions, lessons learned and accountability to elected officials.
Actions for Swiss cantons and municipalities
- Define essential citizen services, maximum outages and manual workarounds with service owners.
- Run a ransomware exercise that includes stolen-data claims, not only system encryption.
- Maintain offline contacts, an alternate public-information channel and pre-approved holding statements.
- Segment backup administration and test restoration from an isolated environment at least annually.
- Map shared-service providers, data locations, evidence duties and notification responsibilities.
- Review retention and access permissions for citizen, employee and procurement information.
- Keep a time-stamped decision log and preserve evidence before rebuilding affected systems.
The Berlin case should not be treated as a distant metropolitan problem. Swiss public bodies face the same combination of constrained resources, complex supplier chains and high expectations for continuity. A tested plan that protects essential services, limits unnecessary data exposure and communicates with discipline will not prevent every attack, but it can prevent a difficult incident from becoming an uncontrolled loss of public confidence.