Cyber Incident Victim: Rhône FM
Date:
Apr 2025
Location:
Switzerland
Summary
Rhône FM experienced a ransomware attack that encrypted its broadcast servers and prompted a ransom demand. Thanks to existing safeguards and staff response, limited transmissions resumed the next morning, with full service expected to be restored later in the week. The broadcaster noted that while some files may have been exfiltrated, sensitive customer data remained protected, and it acknowledged that minor disruptions could persist for a few days.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
Inthe night of 14 to 15 April 2025, cybercriminals targeted the servers of the French‑language Wallis radio station Rhône FM. The attackers encrypted the systems that transmit the station’s various programmes and issued a ransom demand for data recovery. The ransomware used in the attack was identified as belonging to the internationally active group Cloak. Rhône FM confirmed the incident in a statement published on its website and on its online portal.
As a result of the encryption, the radio’s regular broadcast schedule was disrupted beginning early Tuesday morning. Thanks to pre‑existing security measures and the effort of all staff members, the station was able to resume a limited service at 6:30 a.m. on Tuesday. The limited mode allowed some programmes to be aired while the affected servers remained offline. Rhône FM indicated that a full restoration of all server functions would take additional time.
The station expressed hope that normal operations could be restored by Wednesday afternoon, after which it intended to return to its regular programme. Rhône FM could not rule out that the attackers had exfiltrated files from the compromised servers, although it stated that sensitive customer data remained protected. The broadcaster apologized to its listeners and clients for the inconvenience caused by the outage. It also warned that minor service disruptions might persist for several days while the recovery process continued.