Ransomware victim disclosure
← All victimsTRISA AG
listed as www.trisa.ch · Claimed by Lynx · listed 4 months ago
Status timeline
- Listed
Feb 4, 2026
- Data leaked
At a glance
- Group
- Lynx
- Status
- Data leaked
- Country
- Switzerland
- Sector
- Manufacturing
- Listed on leak site
- Feb 4, 2026
About the victim
AI dossier — public-source company profileTRISA AG is a Swiss manufacturer headquartered in Triengen, Switzerland, specialising in the development and production of oral care, hair care, and beauty care products including toothbrushes, electric toothbrushes, interdental cleaners, toothpastes, hairbrushes, and skincare devices. The company has operated for approximately 135 years and conducts research, development, and production in-house, also offering OEM and private-label services. TRISA operates as a group entity and markets its products across Europe and internationally.
- Industry
- Oral Care, Hair Care & Beauty Products Manufacturing
- Address
- Kantonsstrasse 31, 6234 Triengen, Switzerland
- Founded
- 1887
Attack summary
Severity: high — Data has been confirmed as published by the threat actor, indicating successful exfiltration from a manufacturing company with R&D and OEM operations; the victim's own public statement confirms a ransomware intrusion into its IT systems, elevating this beyond a mere listing.The Lynx ransomware group claims to have attacked TRISA AG, with the disclosure status indicating data has been published. TRISA AG's own website acknowledges a ransomware incident in which an attacker gained access to limited areas of its IT systems.
Data the group says was taken
AI dossier — extracted from the leak post- Internal IT system data
- Potentially proprietary product development files
- Potentially business/operational records
What the group claims
TRISA AG specializes in the development and production of high-quality oral care, hair care, and beauty care products, including toothbrushes, electric toothbrushes, and toothpastes.
Sources
Source
Indexed 4 months agoThis page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.
