In short: The National Cyber Security Centre’s (NCSC) Cyber Security Month 2026 runs under the motto “Oversharing – Share with care”. The campaign shows how individually harmless details such as a photo, a phone number or a name can be combined into a detailed profile that criminals use for personalised phishing, identity theft or fraud. A second focus is on business information entered into AI tools.
Key facts
- Campaign: Cyber Security Month 2026, theme “Oversharing – Share with care”, running for four weeks
- Launch: 1 October 2026, NCSC press release
- Risk: combined individual pieces of information enable personalised phishing, identity theft, fraud or targeted manipulation
- AI focus: which personal, confidential or business information can you entrust to an AI tool, and which not?
- Partners: Netpathie (workshops in which young people show older people what oversharing looks like in everyday life) and the FDPIC (AI in the workplace)
- Source: press release of 1 October 2026
Why oversharing is a security risk
A holiday photo, the job title in a profile, the phone number on the website: on their own, such details seem harmless. The NCSC points out that they can be pieced together into a detailed profile. Criminals use such profiles to tailor messages and calls convincingly to their victims.
This fits the current situation: in its semi-annual report 2026/I, the NCSC describes how attackers systematically use artificial intelligence for personalised content and approach victims through data leaks and classified ads, among other channels.
As in previous years, the NCSC is developing the campaign with Netpathie. In workshops, young people show older people what oversharing looks like in everyday life and work out strategies together for sharing more consciously and spotting suspicious situations early.
AI tools in the workplace
The campaign also addresses the use of AI in the workplace, together with the Federal Data Protection and Information Commissioner (FDPIC). The risk arises when personal, confidential or business information is entered into AI tools without thinking. The key question is which information can be entrusted to an AI tool and which cannot.
What this means for Swiss SMEs
- Set AI rules: record in writing which data (customer data, HR data, quotes, contracts) must not go into external AI tools, and which tools are approved.
- Review public information: go through your website, social media and company profiles for information that could help attackers, such as organisation charts, direct numbers and responsibilities for payments.
- Raise employee awareness: the campaign is a good occasion for a short internal training session on personalised phishing.
- Practise verification: always confirm payment and data requests via a second, known channel.
- Assess risk and cover: cyber risk check, emergency procedure under Cyberattack: what to do? and any reporting obligations. Whether social engineering losses are insured differs from policy to policy; see cyber insurance for SMEs, costs and comparison.