THREAT WATCH · September 28, 2026 · RANSOMWARE LISTING

Swiss IT Firm manno.ch Listed on SAFEPAY Ransomware Tracker

The Swiss IT company manno.ch was recorded on the SAFEPAY ransomware tracker on September 28, 2026. The organization, which operates in the IT sector and employs fewer than 50 people, has not made a public statement about the listing. A ransomware tracker entry is a strong signal that an attack may have occurred, but it is not a confirmed breach. Intel128 will continue to monitor this situation and update this post if new information becomes available.

Key takeaways

• manno.ch, a Swiss IT firm, was recorded on the SAFEPAY ransomware tracker on September 28, 2026.
• The company has not made a public disclosure about the listing.
• SAFEPAY is an active ransomware group that publishes victim domains on its own tracker.
• The organization is small, with fewer than 50 employees.

What We Know

• The domain manno.ch appeared on the SAFEPAY ransomware tracker on September 28, 2026.
• The organization is based in Switzerland and operates in the IT sector.
• The company is small, with between 0 and 50 employees.
• As of this writing, manno.ch has not publicly disclosed the listing or confirmed any incident.

About SAFEPAY

SAFEPAY is a ransomware group that maintains a public tracker where it lists organizations it claims to have compromised. The group publishes domain names and, in some cases, additional details about the alleged victims. Like other ransomware operations, SAFEPAY uses public listing as a pressure tactic to encourage payment.

The presence of a domain on a ransomware tracker does not confirm that data was stolen or that systems were encrypted. In some cases, attackers list organizations that never responded to ransom demands or whose systems were not actually compromised. However, a listing should always be treated as a credible indicator that an attack was attempted or occurred.

What This Means for manno.ch

For a small IT firm with fewer than 50 employees, a ransomware listing carries specific risks. Small organizations often have limited security staffing and may lack dedicated incident response capability. If the listing reflects a real compromise, the company could face operational disruption, potential data exposure, and reputational damage.

The absence of a public disclosure is notable but not unusual. Some organizations choose not to comment on ransomware listings, particularly when the incident is still under investigation or when legal counsel advises against public statements. Others may dispute the listing entirely.

What to Watch

• Whether manno.ch issues a public statement or confirms or denies the incident.
• Whether SAFEPAY publishes additional data or files related to the listing.
• Whether Swiss authorities or sector regulators take any action.
• Whether the listing remains on the tracker or is removed, which could indicate a dispute or resolution.

Intel128 Assessment

This listing is recorded as a threat signal, not a confirmed breach. The combination of a small IT firm in Switzerland and an active ransomware group like SAFEPAY warrants attention from security teams, particularly those in the same sector or region. Organizations with dependencies on manno.ch should consider reviewing their own exposure and confirming whether any shared systems or data flows could be affected.

Intel128 will update this post if the disclosure status changes or if additional verified information becomes available.

SOURCE: INTEL128 THREAT INTELLIGENCE FEED (UPDATED OCT 01, 2026). A listing is a record on an attacker-side ransomware tracker - strong signal, not a confirmed breach. Intel128 publishes what the feed shows and no more.