Swiss Cyber Situation Report, Week 43/2026
The situation in three sentences
The volume of reports to the BACS, at 1,198 reports, is slightly above the previous week (1,157) and thus remains at the elevated level of recent weeks. Mass phenomena such as phishing, attempted fraud and spam continue to dominate the statistics, while the general reports have nearly doubled compared with the previous week. Publicly visible ransomware activity in Switzerland remains high, with 36 cases that became known over the last 90 days, and it affects a broad range of sectors.
Key figures of the week
- Total reports: 1,198, compared with 1,157 in the previous week (plus 41)
- Phishing: 443 reports, compared with 419 in the previous week
- Attempted fraud: 343 reports, compared with 372 in the previous week
- General reports: 117 reports, compared with 66 in the previous week
- Spam: 162 reports, compared with 182 in the previous week
- Swiss ransomware cases over the last 90 days: 36 cases that became publicly known
Context for the board of directors and executive management
Structurally, a pattern that has held over recent weeks is confirmed. The large bulk of reports relates to attempted fraud and phishing, that is, to forms of attack that primarily target people and processes and not technical weaknesses alone. These phenomena are relevant to every organisation, regardless of size and sector, because they target the interface between staff, payment workflows and communication. The marked increase in general reports deserves attention, but cannot be explained in substance from the statistics alone and should be kept on the watch list.
The picture remains unchanged for ransomware. With 36 publicly visible cases in 90 days, the threat to Swiss organisations is persistently real and affects industry, healthcare, retail, professional services and technology companies alike. Those affected include both well-known names and smaller operations, which shows that the size of the organisation is no protection. A single actor, which has appeared several times over the last 90 days, accounts for a substantial share of the visible cases, which points to a certain systematic approach. It should be noted that these figures reflect only the part that became public, and that the actual exposure is likely to be higher.
For oversight, this means two things. First, the risk is not shifting towards exotic technical scenarios, but remains with the well-known points of entry: fraud, phishing and encryption attacks. Second, the question for the board of directors is less whether an incident can occur, and more whether the organisation is prepared for a serious event and whether its ability to respond is reviewed regularly. The duty of oversight here does not require detailed technical knowledge, but evidence that risks are identified, assessed and managed, and that executive management can give the body robust information.
Three questions for executive management
- How do we ensure that our payment and approval processes are protected against attempted fraud and phishing, and when was the effectiveness of these controls last reviewed?
- Do we have a tested and rehearsed emergency and recovery plan for the event of a ransomware attack, and when did we last test it with an exercise?
- In a serious event, how would we decide and communicate within a few hours, and have responsibilities towards the authorities, customers and the public been clarified in advance?
The data basis consists of the public reporting statistics of the Federal Office for Cyber Security (BACS) and ransomware cases that became publicly known according to leak-site monitoring (ransomware.live). The figures reflect only publicly reported or visible activity.