A restored backup put a Swiss paint maker back to work within a week of its March 2025 ransomware attack, yet the gang still published the stolen files. Payments are falling while attacks rise, which makes the second half of the extortion, the leak, the part that decides what a victim actually loses.
Table of Contents
Ransomware pays worse than it used to, and its operators have answered by attacking more often. Chainalysis counted about $820 million in on-chain ransom payments in 2025 against a revised $892 million the year before, while claimed attacks rose 50% and the share of victims who paid fell to a record 28%. The median payment still climbed to nearly $60,000. For a company hit today the practical question is narrower than whether to pay: a backup answers only the encryption half of the extortion, and the leak half survives it.
A DW Documentary film uploaded on 7 April 2026 follows that gap through a Swiss manufacturer and a security analyst who spent years talking to the administrator of LockBit. It is a broadcaster’s documentary built on its subjects’ own accounts, with no sponsor named in its description, so what follows tests those accounts against regulators, prosecutors and reporting.
Two stories the film cuts together
The film alternates between a family firm founded in 1947 and an analyst’s undercover work. Its description places the company’s attack in spring 2025 and says the owner’s 200 employees faced a twelve-day deadline. In the interviews, the company’s side says the attackers stole 400 gigabytes, demanded a quarter of a million dollars in Bitcoin and threatened publication, that the backups were hit too, and that a clean copy seven days old was found on day three. The analyst, Jon DiMaggio, describes infiltrating LockBit, befriending its administrator and ending the story with an indictment. A third thread follows a journalist who traced an unusually large payment to a Swiss IT provider. The transcript attributes each figure to an interviewee, not to a document, so each one is a claim to check.
The paint maker’s attacker was Cloak, not LockBit
Swiss trade press reported the attack within days. Netzwoche, citing Inside IT, dated it to 26 March 2025 and said the group Cloak had claimed it, posting the stolen data on 3 April and counting Bosshard-Farben as its first Swiss victim. The company told the federal data-protection commissioner and the National Cyber Security Centre, filed a criminal complaint with Zurich cantonal police, said it would not meet the demands and reported normal operations from 1 April on a rebuilt platform. The film’s transcript never names the group that hit the paint maker, and its LockBit chapters concern a different gang. Two details do not line up cleanly: a twelve-day deadline sits awkwardly beside a leak on day eight, although the film does not say when the clock started, and the transcript names two entry points, a weakly protected remote-access login and, later, the screens on warehouse forklifts.
Restoring from backup solved one of two problems
The film shows how much work a restore is. Its interviewees describe finding that the backups had been touched, searching older copies until one could be verified as clean, and rebuilding from there. The effort worked: the firm said it was trading again on 1 April. What it could not undo was the copy the attackers had already taken, which Cloak published two days later. Paying can look like the cure for that second problem, but the evidence on gangs’ promises is poor. The UK National Crime Agency found that LockBit did not routinely delete stolen data once a ransom was paid, and that some decryptors supplied to paying victims failed. Outside experts quoted by The Record add that victims who pay are more likely to be attacked again. All of this concerns LockBit and general behaviour; the sources reviewed do not say whether Cloak deletes anything.
Payments fall while attacks rise
The film cites estimates that global losses exceed 1 billion dollars a year. That sits close to what Chainalysis tracks as payments, about $820 million in 2025 and perhaps nearer $900 million once more transfers are attributed, so it measures payments, not losses. The Record’s coverage of the same report cites more than $2.5 billion of economic damage from the Jaguar Land Rover attack alone, and US prosecutors said LockBit’s operators extracted at least $500 million in ransoms while causing billions in wider losses. Payment itself is shrinking: Chainalysis ties the 28% payment rate to better incident response, regulatory pressure and the break-up of large gangs into smaller crews. Against a median payment near $60,000, the quarter of a million dollars the film says was demanded from the paint maker sits well above typical payouts, though a demand is not a payment.
The hunt for LockBit’s leader had two tracks
The film credits DiMaggio with befriending the administrator known as LockBitSupp and helping law enforcement catch him. TechCrunch’s account of DiMaggio’s own conference talk is more careful. After his January 2023 report exposed his false personas he kept talking to the administrator, then worked from an anonymous tip to the name Dmitry Khoroshev. He asked the FBI whether to publish, was told to wait, and released his report on 7 May 2024, when the US Justice Department unsealed a 26-count indictment naming the same man. The NCA credits its own Operation Cronos investigation with uncovering the identity. Two tracks converged, and the film folds them into one. The sources also keep Khoroshev’s status modest: he is indicted, sanctioned and subject to a reward of up to $10 million, and he told Krebs, “It’s not me.” They describe charges, not a conviction.
The 2025 leak shows a smaller business than its brand
The film’s second act is the May 2025 hack of LockBit’s own affiliate panel, defaced with a message signed “xoxo from Prague”. TRM Labs analysed the dump, which covered December 2024 to April 2025: about 62,400 Bitcoin addresses, over 4,400 negotiation messages and 75 user accounts. Only 49 addresses showed transaction activity, and LockBit itself said only a lightweight panel was breached. That is a thin trace of a gang whose services, the NCA says, were used to build more than 7,000 attacks between June 2022 and February 2024, and whose 194 identified affiliates included up to 114 who never earned a ransom. The film says the leak listed victims and who paid how much. TRM describes chats and wallets, with amounts recovered by tracing the blockchain, and records a ransom of roughly 2 million dollars paid to one affiliate without naming the victim. That matches the order of magnitude of the Swiss payment the film describes, but the sources reviewed cannot connect the two. The IT provider says it did not pay, and the journalist infers that a customer did.
State protection is documented for Evil Corp
An expert in the film says ransomware gangs are tied to the Russian government and are free to hit the West. The strongest public evidence concerns a different group. On 1 October 2024 the US Treasury, acting with the UK and Australia, said Eduard Benderskiy, a former FSB officer and father-in-law of the leader of Evil Corp, protected the group and kept Russian authorities from pursuing its senior members. For LockBit, the US indictment, as reported by Krebs, describes Khoroshev as a Russian national from Voronezh who typically took a fifth of each ransom, and neither it nor the NCA release alleges direction from the state. The film’s claim about unwritten rules that spare former Soviet countries comes from its expert and was not tested against the sources reviewed.
Three steps for a mid-sized manufacturer
For an owner or IT manager at a plant of this size, the evidence supports three conditional steps. Rehearse restoring from backups, including checking that the copy is clean, because the film’s team found its backups touched. Plan for publication of the stolen data as the likely result of refusing to pay, and prepare the reporting chain: the Swiss firm informed the data-protection commissioner, the cyber centre and the police. Close the front door: the Swiss cyber centre recommends multi-factor authentication and current patches, and a weak remote-access login is the entry the interviewees describe. Do not expect a legal shield. The UK payment ban consulted on in January 2025 covered public bodies and critical infrastructure and left manufacturing outside, and an NCC Group expert warned that this could push attackers toward manufacturers. Swiss voluntary reports show the pressure: 79 ransomware incidents in the second half of 2025 against 47 a year earlier, with Akira behind 26.
Author:
Jan Bielik
CEO & Founder of Webiano Digital & Marketing Agency
This article is an original analysis supported by the sources cited below
Cyberattacks, data encryption, extortion – How cybercriminals operate | DW Documentary
The video page and supplied transcript, which give the spring 2025 attack, the twelve-day deadline, the interviewees’ figures and the LockBit infiltration story tested in this article.
LockBit leader unmasked and sanctioned
The UK National Crime Agency’s account of Operation Cronos: more than 7,000 attacks, affiliates who never earned a ransom, failed decryptors and stolen data not routinely deleted after payment.
Treasury Sanctions Members of the Russia-Based Cybercriminal Group Evil Corp in Tri-Lateral Action with the United Kingdom and Australia
The US Treasury’s finding that a former FSB officer protected Evil Corp’s leadership from Russian authorities, the documented state link contrasted with LockBit.
Zunahme von Cyberangriffen durch Ransomware und Phishing
The Swiss federal cyber centre’s half-year figures: 79 voluntarily reported ransomware incidents in late 2025 against 47 a year earlier, Akira’s 26 cases and the multi-factor authentication advice.
Cyberkriminelle leaken Daten von Bosshard-Farben im Darknet
Swiss trade reporting dating the paint maker’s attack to 26 March 2025, naming Cloak as the claimant, the 3 April data publication, the authority reports and the return to normal operations on 1 April.
Ransomware payments dropped in 2025 as attack numbers reached record levels: Chainalysis
Coverage of Chainalysis’s annual figures: about $820 million paid, a 28% payment rate, 50% more claimed attacks, a rising median payment and outside experts on why paying rarely helps victims.
U.S. Charges Russian Man as Boss of LockBit Ransomware Group – Krebs on Security
The 26-count indictment of Dmitry Khoroshev, the prosecutors’ figures of at least $500 million in ransoms and his denial that the authorities had named the right person.
How a cybersecurity researcher befriended, then doxed, the leader of LockBit ransomware gang
The analyst’s own account of finding Khoroshev from a tip, checking with the FBI and publishing only after the Justice Department named the same man.
LockBit Leak Provides Insight into Ransomware-as-a-Service (RaaS) Enterprise
Blockchain analysis of the May 2025 panel leak: 62,400 addresses of which only 49 showed activity, over 4,400 negotiation messages and a roughly 2 million dollar ransom to one affiliate.
UK Considers Banning Ransomware Payments
The January 2025 UK proposal to ban payments by public bodies and critical infrastructure, and the warning that manufacturers outside its scope could become likelier targets.
| Citing this article? Brief excerpts are welcome. Please credit Webiano.digital, name the author where stated, and include a link to https://webiano.digital and to this original article. Full or substantial republication requires prior written permission. Read our Copyright and Content Use Policy. |
This article was prepared with the assistance of artificial intelligence tools. The content underwent expert human review, and Webiano Digital & Marketing Agency assumes editorial responsibility for its final version and publication.
