ENB Versicherungen | myenb.ch Listed by payload Ransomware Group

On June 20, 2026, Swiss insurance broker enb AG appeared on the leak site of the ransomware group Payload, with the attackers claiming to have exfiltrated internal files from the company’s systems.

Confirmed Facts from Reporting

Public reporting indicates that enb AG, which operates the myenb.ch platform, was listed by the Payload ransomware group on that date. The company is an independent insurance intermediary that works with major insurers to arrange health, vehicle, liability, and corporate pension policies for private individuals and businesses. Available reporting describes the incident as a ransomware attack in which internal files were taken; the exact volume of data and the number of people affected remain unconfirmed by the company. No evidence has surfaced that customer policy documents or payment details were specifically published, but the mere listing on a ransomware leak site signals that sensitive business records may now sit in attackers’ hands.

Why This Matters for You and Your Family

When an insurance broker’s internal files are stolen, the information inside often includes names, addresses, dates of birth, policy numbers, claims history, and contact details for both individual customers and small businesses. Insurance records are especially valuable because they frequently link to banking information, employment details, and family members listed on policies. For an ordinary person, this means your name, address, and phone number could be combined with data from other breaches to build a profile that makes identity theft, fraudulent claims, or targeted scams far easier. Your family’s protection—health coverage, car insurance, home liability—depends on the security of exactly these records. Once they leave the broker’s control, you lose the ability to contain how that information travels.

The Doxxing and Identity-Chain Implications

Ransomware leaks rarely stop at one company. A single exposed insurance file can connect your email address, phone number, and home address to usernames you use elsewhere. Attackers then follow those links across social media, gaming platforms, and shopping accounts. Credential leaks like this one routinely cascade into account takeovers, especially for gaming accounts belonging to you or your children. A teenager’s username tied to a family email suddenly becomes a doorway for harassment or further extortion. The chain grows quickly: one insurance record can expose enough personal anchors to map an entire household’s digital footprint.

Payload Group’s Known Track Record

Public reporting attributes the attack to the Payload ransomware group. The group emerged in late 2024 and has since listed dozens of victims, primarily mid-sized companies in Europe and North America. Notable prior targets include logistics firms, manufacturers, and professional-services providers. Their typical playbook begins with initial access through compromised credentials or vulnerable remote-desktop services, followed by exfiltration of internal documents before encryption. They then demand payment and, if unmet, publish samples or full datasets on their leak site. The group’s extortion style focuses on business disruption and reputational pressure rather than immediate mass publication of consumer records, although any data they release can be scraped and reused by other criminals.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real-world identity so you can see exactly what this breach connects to.
• Rotate the password you used at myenb.ch anywhere else it is reused, and switch on two-factor authentication through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 15.4 billion breach records and more than 100 platforms so the next leak exposing you is caught in hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often chain back to the same address or parent email.
• Let remediation specialists handle takedown requests across data brokers and exposed records while you focus on securing your own accounts.

The incident shows that even companies trusted with your most personal protection details can lose control of that information without warning. A forward-looking step is to treat every new breach listing as a signal to map and lock down your full identity chain before criminals do it for you. DoxxScan by GalaxyWarden delivers exactly that: continuous monitoring across 15.4B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Starting that process now gives you and your family a practical defense against the next leak that inevitably follows.