Ransomware poses an existential threat to businesses. It’s a form of cybercrime that’s a highly professional industry. The criminals operate like a business – by infiltrating systems, encrypting data, and extorting money.

Those who refuse to pay, face operational shutdown, loss of data, and bankruptcy. Many criminal groups have a division of labor that’s similar to that of companies, with teams of developers, negotiators, ‘customer support,’ and clear deadlines. This documentary shows how almost any company can be targeted and how quickly an attack can threaten the very survival of the business. In the spring of 2025, Philipp Bosshard’s company was hit. It wasn’t just the IT system that went down, the entire company ground to a halt. The future of the business and the jobs of its 200 employees were at stake. The hackers set a deadline: Bosshard had twelve days to decide whether to pay the ransom or see if he could somehow find another solution.

The documentary also tracks the cybercriminals themselves. Through months of undercover investigations, cybersecurity analyst Jon DiMaggio managed to infiltrate one of the most notorious ransomware gangs: Lockbit. He even engaged with the group’s mysterious leader, who went by the name “LockbitSupp” – befriending him and ultimately unmasking his identity.

When Lockbit itself was hacked in 2025, the inner workings of the gang were laid bare. Data journalist Simon Huwiler analyzed the leaked data and stumbled on one unusually large ransom payment, with a trail leading to Switzerland…