Küng Ag Bern Listed by noescape Ransomware Group

On September 10, 2023, Swiss fuel distributor Küng Ag Bern appeared on the leak site of the noescape ransomware group. The company, which handles wholesale trade and distribution of mineral oil products under the AVIA brand and operates significant storage facilities in the Bern area, is claimed to have had internal files exfiltrated during a ransomware attack. The exact number of people whose data may have been exposed remains unknown, as neither the leak-site listing nor the company’s subsequent notifications quantify affected records.

Details from the Leak Site

The primary disclosure on the noescape onion site states that internal files were exfiltrated from Küng Ag Bern. The listing does not specify the volume or exact types of data stolen beyond claiming that sensitive company documents were taken. No ransom demand figure is published, and the post does not list individual customer or employee records. The disclosure indicates the data was obtained through a ransomware deployment, after which the threat actors chose to publish a sample on their leak portal when negotiations presumably failed.

Why This Matters for You and Your Family

When a regional fuel supplier like Küng Ag Bern suffers a breach, anyone who has done business with them — whether as a heating-oil customer, fleet operator, or employee — may have personal information at risk. Internal files often contain names, addresses, phone numbers, contract details, payment records, and correspondence. For ordinary households in the Bern region this translates into concrete exposure: your home address linked to fuel consumption patterns, banking references, or insurance information. Once such data leaves the company’s control, it can be packaged, sold, or used as the foundation for more targeted attacks against you and your family.

The Doxxing and Identity-Chain Risk

Exfiltrated internal files rarely exist in isolation. A single leaked document can tie your email address to a physical delivery address, telephone number, and sometimes date of birth or vehicle registration. Threat actors then cross-reference these details with other breaches, building an identity chain that links your online handles to your real-world identity. This chaining process turns one breach into persistent exposure across dozens of platforms. Credential leaks of this nature also cascade into gaming accounts belonging to you or your children; a reused password taken from a fuel-company file can hand over a Roblox, Steam, or Discord account, which in turn reveals additional personal photos, chat logs, and location data.

Noescape Ransomware Group Track Record

Public reporting attributes the noescape group’s first significant activity to mid-2023. The operators employ a double-extortion model: they encrypt victim systems and simultaneously exfiltrate data before demanding payment to prevent publication. Notable prior victims include other mid-sized European distributors and service companies. Their typical playbook begins with phishing or exploitation of remote-access tools for initial access, followed by lateral movement, data collection, and deployment of custom ransomware. After exfiltration they wait a short period before listing samples on their leak site, applying pressure through countdown timers and selective release of sensitive documents.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup of Warden to remove what you can.
• Rotate any password you ever used at Küng Ag Bern or AVIA anywhere it has been reused, and switch on 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your data surfaces the exposure is caught in hours, not months.
• Cover the household — DoxxScan family coverage extends to dependents and children’s gaming accounts that often chain back to the same address or reused credentials.
• Let the remediation specialists handle takedown requests across data brokers and leak sites for you while you focus on securing your own accounts.

The breach of Küng Ag Bern illustrates how even regional service providers hold data that can fuel long-term identity abuse. Acting quickly on credential hygiene and identity mapping limits how far attackers can travel down the chain. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Start your DoxxScan trial today to regain control of your exposed information before the next attacker does.