Search I’ve been hacked Advice Menu
I’ve been hacked
For me Overview: For me
For businesses Overview: For businesses
Costs and comparison Overview: Costs and comparison
Swiss threat landscape Overview: Swiss threat landscape

How often is Switzerland hit?

In 2025, the NCSC received 64'733 reports, one every 8 minutes on average. In the first half of 2026 there were 27'128, fewer for the first time.

High, stable to declining for the first time in 2025/2026

As of

21'714 2021 34'527 2022 49'380 2023 62'954 2024 64'733 2025 27'128 H1 2026
Voluntary reports to the NCSC. * calculated; the NCSC reported “almost 50'000”. Source: NCSC
On this page
  1. Cold storage
  2. Trends
  3. Swiss cases
  4. All figures

Cold storage wave since 12.10.2026

Since October 2026, attackers in several European countries have been manipulating refrigeration systems via the internet. In France, Belgium, Sweden and Germany, temperatures in hundreds of supermarkets and at least two butcher’s shops rose to 50 degrees and more; food had to be destroyed.

  • over 230 branches in France

  • around 60 in Belgium and Luxembourg

  • 0 known cases in Switzerland As of

not covered The cyber policy excludes property damage, the property policy often excludes cyber attacks. Who pays for the goods?

Our check and the sources

Claim “There are currently various cases in which the refrigeration systems of butcher’s shops have been hacked and the temperature changed, and the goods were no longer edible.”: partly accurate. Essentially correct, but not mainly for butcher’s shops. Since 12 October 2026, a wave of attacks on internet-accessible refrigeration control systems (mainly Danfoss, plus Copeland and Dixell) has been under way in Europe: France (more than 230 supermarkets), Belgium and Luxembourg (around 60 supermarkets), Sweden, Germany (Bavaria, North Rhine-Westphalia), plus an attempt at the French blood donation service. Temperatures were set to 50 to 150 degrees, and in Belgium alone goods worth around 100'000 euros were destroyed. Two butcher’s shops are documented: the Belgian chain De Laet en Van Haver and a butcher’s shop in the Upper Palatinate (five-figure loss, discovered in time). Since 05.11.2026, a Swiss case has also been known: at the butcher’s shop Lüthi's Fleischwaren in Köniz, the temperature in the freezer rose to 50 to 70 degrees, some of the meat was as if cooked, and the shop remained closed (V-CH-2026-038). This means that spoiled goods are also documented at a butcher’s shop. By 06.11.2026, the NCSC had published neither a case nor a warning. Before the wave, we found no documented case of this kind.

  • Wave confirmed by the authorities: on 12.10.2026, the French authority CERT-FR reported numerous compromised remote controls of refrigeration systems. The Danfoss AK-SM and AK-SC series as well as Copeland and Dixell xweb are affected. Further attacks are likely. Recommendation: disconnect devices from the internet immediately, check defrost schedules, access only via VPN, update firmware, change default passwords; do not operate devices without updates on the internet any longer. Notable for policyholders: CERT-FR advises checking the insurance conditions before cutting the connection to the refrigeration technician.
    Where does it say so?

    CERTFR-2026-ALE-012: Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération, 2026-10-12, aktualisiert 13. und 16.10.2026

    «Des campagnes d'attaques sont probablement toujours en cours visant ces équipements.»

    Open document: CERTFR-2026-ALE-012: Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération (opens in a new window), retrieved 06.11.2026

  • France, night before 12.10.2026: around 150 Intermarché branches, 80 Carrefour sites and Coopérative U shops. The systems were switched to defrost mode, for around six hours at up to 50 degrees. Meat, frozen goods and vegetables were disposed of. Mostly older Danfoss control systems (AK-SM 800, AK-SC 355) without security updates were affected. The Paris public prosecutor’s office and ANSSI are investigating.
    Where does it say so?

    Cyberangriff auf französische Supermarkt-Kühlschränke: Hunderte Waren verdorben, 2026-10-12

    Open document: Cyberangriff auf französische Supermarkt-Kühlschränke: Hunderte Waren verdorben (opens in a new window), retrieved 06.11.2026

  • Spread up to the beginning of November: Belgium (around 40 Delhaize, 15 Carrefour, 5 Spar, refrigeration units set to 70 degrees, food worth around 100'000 euros destroyed), Luxembourg (Delhaize), Sweden (ICA, Coop; one shop closed temporarily). In France, all thawed goods were disposed of. The Belgian butcher’s chain De Laet en Van Haver also reported attacked refrigeration units. It has not been confirmed whether the same method was used everywhere. The perpetrators and motive are unknown.
    Where does it say so?

    Kühlschränke in Lebensmittelläden weiterer Länder geknackt, 2026-11-02

    «Sämtliche aufgetauten Lebensmittel mussten aus hygienischen Gründen entsorgt werden.»

    Open document: Kühlschränke in Lebensmittelläden weiterer Länder geknackt (opens in a new window), retrieved 06.11.2026

  • Butcher’s shop in the Upper Palatinate (Bavaria): unknown persons set several cold stores to as much as 150 degrees. The manipulation was discovered in time, and the loss is in the five-figure euro range. The Weiden criminal police are investigating for data alteration, computer sabotage and criminal damage. The report does not say whether goods spoiled. The original report of the Bavarian police could not be found (the list loads dynamically).
    Where does it say so?

    Cyberangriff auf Metzgerei: Kühlanlagen manipuliert, 2026-11-04

    «Der entstandene Schaden liegt im fünfstelligen Eurobereich.»

    Open document: Cyberangriff auf Metzgerei: Kühlanlagen manipuliert (opens in a new window), retrieved 06.11.2026

  • Further German cases: Edeka supermarket in Reisbach (Lower Bavaria), refrigeration systems at 50 degrees, a lot of goods disposed of. The police have not yet confirmed a cyber attack. In addition, there are reports from North Rhine-Westphalia of attacks on freezers. The operator defends the internet connection because it enables round-the-clock remote monitoring. The BSI advises disconnecting systems from the internet.
    Where does it say so?

    Cyberangriffe auf Kühlschränke: Erste deutsche Fälle in Bayern und NRW, 2026-11-03

    «Der wichtigste und zugleich einfachste Schutz ist es, die Anlagen vom Internet zu trennen»

    Open document: Cyberangriffe auf Kühlschränke: Erste deutsche Fälle in Bayern und NRW (opens in a new window), retrieved 06.11.2026

  • Spread to other refrigerated goods: at the French blood donation service EFS, during the night before 2.11.2026, attackers set the target temperature of the plasma refrigeration to 110 degrees. A technician intervened in time, and nothing was lost. According to heise, there were also attempts in pharmaceutical distribution.
    Where does it say so?

    Kühlgeräteangriffe: Bis aufs Blut verwundbar, 2026-11-04

    «Die Angreifer sollen die Zieltemperatur auf 110 Grad Celsius gesetzt haben.»

    Open document: Kühlgeräteangriffe: Bis aufs Blut verwundbar (opens in a new window), retrieved 06.11.2026

  • Germany, BSI: cyber security recommendation BSI-CS 154 of 13.10.2026 is aimed at operators of small installations that are not part of critical infrastructure. As an example of application it names the refrigeration of food; this also concerns butcher’s shops, bakeries and shops. The full-text PDF was not opened.
    Where does it say so?

    BSI-CS 154: Gefährdung durch internet-verbundene OT-Systeme, 2026-10-13

    «Diese Cybersicherheitsempfehlung richtet sich insbesondere an Betreiber kleiner industrieller oder vergleichbarer Anlagen»

    Open document: BSI-CS 154: Gefährdung durch internet-verbundene OT-Systeme (opens in a new window), retrieved 06.11.2026

  • Expert criticism of the manufacturers: an IT security expert from Karlsruhe criticises the fact that control systems are delivered and operated with factory settings and default passwords. He calls this «completely unforgivable». From 11.09.2026, the first reporting obligations of the EU Cyber Resilience Act apply.
    Where does it say so?

    Cyberangriffe auf Kühlsysteme: Hersteller in der Kritik, 2026-11-04

    «Es muss nicht alles ins Internet.»

    Open document: Cyberangriffe auf Kühlsysteme: Hersteller in der Kritik (opens in a new window), retrieved 06.11.2026

  • Switzerland: no case known. As of 06.11.2026, the NCSC has published nothing about the attacks on refrigeration systems, neither in the weekly reviews (weeks 40 to 44) nor under «Current incidents» or «In focus». In the half-year report 2026/I, it states that it is not aware of any sabotage against Swiss targets. We consider a spread to Switzerland plausible because the same control systems are sold internationally (own assessment, not documented).
    Where does it say so?

    Halbjahresbericht 2026/I (Januar–Juni), 2026-08, S. 9

    «In Bezug auf die Schweiz sind dem BACS keine Cybersabotageangriffe gegen Schweizer Ziele bekannt.»

    Open document: Halbjahresbericht 2026/I (Januar–Juni) (opens in a new window), retrieved 06.11.2026

  • The only earlier Swiss butcher’s shop case: Metzgerei Wechsler, Nebikon LU (50 employees), October 2018. Ransomware came in via the router; labelling scales and delivery notes failed, costs around 20'000 francs. Refrigeration was not affected.
    Where does it say so?

    Metzger Wechsler und die Hacker (Magazinbeitrag, PDF bei Compass Security), 2019-01, S. 7

    «Auch die Fleischwaagen sind mit dem System verbunden und darum ausgefallen.»

    Open document: Metzger Wechsler und die Hacker (Magazinbeitrag, PDF bei Compass Security) (opens in a new window), retrieved 06.11.2026

  • Documented vulnerabilities in cold room control systems: Copeland E3 Site Supervisor has a built-in admin account with a predictable daily password (part of «Frostbyte10», Armis, 2025; severity 9.8 out of 10). For Danfoss, Claroty reported vulnerabilities in August 2026, including a hidden login mechanism; this is documented only via heise, and the original report was not opened.
    Where does it say so?

    CVE-2025-6519 (Copeland E3 Site Supervisor), 2025-09-02, Beschreibung, CVSS 3.1: 9.8

    «E3 Site Supervisor (firmware version < 2.31F01) has a default admin user "ONEDAY" with a daily generated password.»

    Open document: CVE-2025-6519 (Copeland E3 Site Supervisor) (opens in a new window), retrieved 06.11.2026

  • Dixell XWEB-500 (Emerson, now Copeland): a vulnerability allows arbitrary files to be written without logging in, up to and including takeover of the device (9.8 out of 10). The product has not been maintained since 2018. CERT-FR counts Dixell and Copeland xweb among the devices affected by the 2026 wave.
    Where does it say so?

    CVE-2021-45420 (Emerson Dixell XWEB-500), 2022-02-14, Beschreibung, CVSS 3.1: 9.8

    «Emerson Dixell XWEB-500 products are affected by arbitrary file write vulnerability»

    Open document: CVE-2021-45420 (Emerson Dixell XWEB-500) (opens in a new window), retrieved 06.11.2026

  • Before the wave: the closest documented case of a manipulated temperature was a grain drying silo in Canada (hacktivists, 2025). As early as 2013, perpetrators got into Target’s network using login data of a refrigeration and air conditioning technician. At Americold (2023), Bakker Logistiek (2021), JBS (2021) and Arla (2025), ransomware hit the IT, not the refrigeration.
    Where does it say so?

    AL25-016: Internet-accessible industrial control systems (ICS) abused by hacktivists, 2025-10-29

    «where temperature and humidity levels were manipulated, resulting in potentially unsafe conditions if not caught on time»

    Open document: AL25-016: Internet-accessible industrial control systems (ICS) abused by hacktivists (opens in a new window), retrieved 06.11.2026

  • Outlook on AI: the NCSC expects that, with AI, even perpetrators without specialist knowledge will find and manipulate poorly protected control systems. As an example, it cites an AI-assisted attack on a water supply in Mexico (2026). It is not known whether AI was involved in the refrigeration wave.
    Where does it say so?

    Halbjahresbericht 2026/I (Januar–Juni), 2026-08, S. 9–10

    «ungenügend geschützte Systeme opportunistisch zu identifizieren und anschliessend zu manipulieren»

    Open document: Halbjahresbericht 2026/I (Januar–Juni) (opens in a new window), retrieved 06.11.2026

  • First Swiss case (addendum 08.11.2026): at the butcher’s shop Lüthi's Fleischwaren in Köniz, attackers manipulated the control system of the refrigeration and freezer systems; according to the owner, the temperature rose to 50 to 70 degrees. The systems were disconnected from the network and the shop was closed. At Coop, attack attempts were unsuccessful, according to a spokeswoman.
    Where does it say so?

    Update: Angriffswelle auf Kühlanlagen erreicht die Schweiz, 05.11.2026

    «Erstmals ist ein erfolgreicher Angriff auf Kühlanlagen in der Schweiz öffentlich bekannt geworden.»

    Open document: Update: Angriffswelle auf Kühlanlagen erreicht die Schweiz (opens in a new window), retrieved 08.11.2026

  • Not checked (gap): original reports from Reuters, Euronews and NOS as well as the police reports from Bavaria, the reports from Danfoss and Claroty, the full-text PDF of the BSI and figures on openly accessible refrigeration control systems in Switzerland (Shodan). Reason: the session’s web search quota had been used up; the wave is documented via CERT-FR, BSI, heise and Handwerksblatt. A Swiss case may already have happened without having been published.

Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.

13 trends from reports by authorities and studies. Tap for the full text and sources.

  • Case numbers in Switzerland: high, stable to declining for the first time in 2025/2026

    Reports to the NCSC tripled from around 21'700 (2021) to 64'733 (2025); in the 1st half of 2026 they fell to 27'128 (H1 2025: 35'727). In 2025, the police recorded 57'761 digital offences, almost twice as many as in 2021, but 2% fewer than in 2024; only 17.6% are solved, and 4.3% for online investment fraud. The NCSC stresses that despite the lower volume, attacks are becoming more targeted, more emotional and technically more sophisticated.

  • Fraud dominates, telephone becomes the most important channel

    Fraud accounts for 39 to 58% of reports. Fake calls from authorities fell sharply thanks to measures against call spoofing (fewer than 100 per month from July 2026). At the same time, voice phishing (calls from fake bank employees, callback scams) has been the most frequently reported phishing method since 2026, supplemented by Twint phishing via classified ads.

  • Companies: account takeovers, CEO fraud and invoice manipulation

    At companies, CEO fraud (484 → 719 → 970 reports 2023–2025) and invoice manipulation (73 in H2 2025, one case with a loss of CHF 1.5 million) increased. In 2026, the NCSC reports more hijacked Microsoft 365 accounts, even despite multi-factor authentication, with losses running into millions. The police count 560 CEO/BEC cases (+11%).

  • Ransomware: more attacks, fewer payments

    Ransomware is involved in almost half of the data breaches examined (Verizon 48%), and leak site cases rose by 50% in 2025. At the same time, fewer and fewer victims are paying: Coveware measured 23% in Q3 2025, and in Q3 2026 almost 80% of cases ended without payment; Chainalysis estimates 28%, the BKA 7% of those reported. Ransom amounts vary widely depending on the source (median from around 60'000 to USD 1 million). In Switzerland, the market is breaking up into more groups (29 families), with Akira remaining the leader.

    • Verizon Business: 2026 Data Breach Investigations Report – Executive Summary (19. Ausgabe; >31'000 Vorfälle, >22'000 bestätigte Datenverletzungen)
    • Chainalysis: Ransomware (Kapitel Crypto Crime Report 2026)
    • Coveware by Veeam: Insider Threats Loom while Ransom Payment Rates Plummet (Quartalsbericht Q3 2025)
    • Bundesamt für Cybersicherheit BACS: Halbjahresbericht 2026/I (Januar–Juni): Cybersicherheit – Lage in der Schweiz und international
  • SMEs underestimate their risk, the insurance market is growing, the gap remains

    Only 6% of micro and small businesses report a serious incident in three years, but in the Deloitte survey 49% of employees report a serious incident in three months; only 22% consider the risk to be high. Premium volume in Switzerland rose to CHF 182 million in 2025, by 21% for private individuals and only by 3.4% for companies. Nevertheless, only 11.5% of all companies are insured, and 5–10% of SMEs. Worldwide, Munich Re estimates the market at just under USD 15 billion (2025), with slower growth.

    • Die Mobiliar: «KMU Cybersicherheit 2026»: Cyberkriminalität wird zum Geschäftsrisiko für Schweizer KMU (Medienmitteilung; Studie Mobiliar, digitalswitzerland, HES-SO, HWZ, SATW, unterstützt vom BACS; n=507, YouGov, 24.06.–10.07.2026)
    • Deloitte Schweiz: Schweizer KMU unterschätzen Cyberrisiken massiv – Grundschutz und Versicherungsschutz bleiben lückenhaft (Onlineumfrage, n=924 Arbeitnehmende in Firmen bis 249 MA, April 2026)
    • Netzwoche (Quelle: SVV via Swissinfo): Markt für Cyberversicherungen boomt (SVV-Zahlen 2024)
    • blue News (Quelle: Schweizerischer Versicherungsverband SVV): Cyber insurance is becoming increasingly popular (zur SVV-Jahresumfrage 2025)
    • Munich Re: Global Cyber Risk and Insurance Survey 2026
  • Cost per incident: swings in both directions

    For 2026, IBM measures a record of USD 4.99 million per data breach (2025: 4.44 million). Sophos sees falling recovery costs in 2025 (USD 1.53 million) and 1.7 million again in 2026. Bitkom estimates the loss to the German economy in 2026 to be lower than in 2025 (211 instead of 289 billion euros), but with a higher cyber share (76%). The studies measure different things and are not directly comparable.

    • IBM / Ponemon Institute: IBM Study: One in Four Malicious Breaches are AI-Enabled, Costing Companies $6 Million on Average (Cost of a Data Breach Report 2026; n=602 Organisationen, März 2025–Feb. 2026)
    • Sophos: Median Ransom Payment is $1 Million; Yet 53% of Companies Negotiated a Lower Amount than the Initial Demand (State of Ransomware 2025; n=3'400, 17 Länder)
    • Bitkom e.V. / Bitkom Research: Wirtschaftsschutz 2026 (Präsentation; CATI-Befragung n=1'003 Unternehmen ab 10 Beschäftigten)
  • AI: consensus of the authorities, an accelerator, not a break

    The Federal Council/NCSC, UK NCSC and GTIG agree: AI does not change the basic patterns, but makes existing attacks faster, more numerous and more credible. As early as 2024, the UK NCSC stated that AI will «almost certainly» increase the volume and impact of attacks, especially in social engineering. The Federal Council expects the quantity and quality of attacks to continue to increase.

  • AI: deepfakes and voice clones in fraud are documented

    In 2025/2026, the NCSC documents deepfake advertising with celebrities for investment fraud, a CEO fraud with a cloned voice and romance scams with AI identities and deepfake video calls. In 2025, the FBI reported AI-related cases for the first time (22'364 complaints, USD 893 million). IBM names deepfake impersonation as the most common AI attack route; according to Bitkom, German companies recognise AI attacks above all by automatically adapted attacks (53%) and faked audio/video recordings (48%).

  • AI: from aid to (partly) autonomous attacks

    At the beginning of 2025, Google saw only productivity gains. Since autumn 2025, there has been evidence of more: malware that queries a language model while running (GTIG), an extortion campaign against 17 organisations using Claude Code and a state espionage campaign in which AI did 80–90% of the work (Anthropic). According to the NCSC, AI suggested targets in an attack on a water supply in Mexico. However, the UK NCSC considers fully autonomous attacks unlikely before 2027.

  • AI: the speed of vulnerabilities and attacks is increasing

    The UK NCSC expects AI to further shorten the time between a vulnerability becoming known and its exploitation. In 2026, Verizon for the first time measures the exploitation of vulnerabilities as the most frequent initial access (31%); only 26% of critical vulnerabilities had been fully remedied. CrowdStrike measures an average breakout time of 29 minutes (2024: 48). The connection with AI is plausible but not quantitatively documented.

  • AI: hype vs. evidence, the figures diverge widely

    The figures on the impact of AI diverge widely: ENISA cites more than 80% AI-assisted social engineering (from third-party sources), IBM in 2025 only 16% of data breaches involving AI and in 2026 one in four malicious ones. At the FBI, AI cases account for around 4% of losses. Verizon finds that AI-assisted malware almost only replicates known techniques (less than 2.5% novel). The impact on deception (texts, voices, videos) is well documented; new technical capabilities are poorly documented. Forecasts such as Deloitte’s USD 40 billion in fraud losses by 2027 are scenarios, not measurements.

    • ENISA (EU-Agentur für Cybersicherheit): ETL 2025: EU consistently targeted by diverse yet convergent threat groups (ENISA Threat Landscape 2025, 4'875 Vorfälle 07.2024–06.2025)
    • IBM / Ponemon Institute: IBM Report: 13% Of Organizations Reported Breaches Of AI Models Or Applications, 97% Of Which Reported Lacking Proper AI Access Controls (Cost of a Data Breach Report 2025)
    • Verizon Business: 2026 Data Breach Investigations Report – Executive Summary (19. Ausgabe; >31'000 Vorfälle, >22'000 bestätigte Datenverletzungen)
    • Deloitte Center for Financial Services (USA): Deepfake banking and AI fraud risk on the rise
  • AI as a new attack surface: shadow AI and AI systems

    Besides AI as a weapon, AI in the business’s own operations becomes a risk. IBM reports for 2025 that 13% of organisations suffered attacks on AI models or applications, 97% of them without AI access controls; in 2026 the figure is more than 20%. According to Verizon, 45% of employees regularly use AI on company devices, often with private accounts. For insurers, AI thus also becomes a matter of obligations and exclusions.

    • IBM / Ponemon Institute: IBM Report: 13% Of Organizations Reported Breaches Of AI Models Or Applications, 97% Of Which Reported Lacking Proper AI Access Controls (Cost of a Data Breach Report 2025)
    • IBM / Ponemon Institute: IBM Study: One in Four Malicious Breaches are AI-Enabled, Costing Companies $6 Million on Average (Cost of a Data Breach Report 2026; n=602 Organisationen, März 2025–Feb. 2026)
    • Verizon Business: 2026 Data Breach Investigations Report – Executive Summary (19. Ausgabe; >31'000 Vorfälle, >22'000 bestätigte Datenverletzungen)
  • Control systems in small businesses are being attacked: refrigeration wave since October 2026

    Attacks on operational technology (OT) no longer affect only power stations and water suppliers. Since October 2026, internet-accessible refrigeration control systems have been manipulated on a large scale in France, Belgium, Luxembourg, Sweden and Germany, and hundreds of shops have lost goods. CERT-FR and the BSI advise disconnecting such systems from the internet; the BSI expressly addresses operators of small installations. For insurers, property damage as a consequence of a cyber attack (spoiled goods) thus becomes a real item of loss.

113 cases in Switzerland

Publicly reported incidents. The houses show the 45 cases where the canton is known.

Map of Switzerland with 45 cases by canton Chur GR, 2026Köniz BE, 2026Canton of Vaud, 2026Canton of Fribourg, 2026Sulgen TG, 2026Lenzerheide GR, 2026Lausanne VD, 2026Cantons of Aargau, Lucerne, Schaffhausen, Vaud and Zug, 2026Martigny-Combe VS, 2026Zurich, 2026Canton of Vaud, 2026Canton of St. Gallen, 2026Canton of Vaud, 2026Vétroz VS, 2026Châtel-St-Denis FR, 2026Canton of Schwyz, 2026Canton of St. Gallen, 2026Villars-sur-Glâne FR, 2025Canton of Bern, 2025Canton of Fribourg, 2025Zurich, 2025Schaffhausen SH, 2025Basel, 2025Lausanne VD, 2024Canton of Aargau, 2024Brunnen SZ, 2024Central Valais VS, 2024Zug (Hagendorn, municipality of Cham), 2023Canton of Solothurn, 2023Steckborn TG, 2023Saxon VS, 2023Canton of St. Gallen (Goldach, St. Gallen, Thal), 2023Bern, 2023Neuchâtel NE, 2022Hinwil ZH, 2022Zurich Airport, 2022Montreux VD, 2021Morges VD, 2021Canton of Geneva, 2021Rolle VD, 2021Wetzikon ZH, 2019Mörschwil SG, 2019Zurich region, 2018Nebikon LU, 2018Barbengo TI, 2016

All 197 incidents, including abroad

All figures with sources

Switzerland: figures from the NCSC, FSO and police (61)
Switzerland: figures from the NCSC, FSO and police, as of 08.11.2026
Key figureValueYearSource
NCSC: voluntary reports of cyber incidents, full year 64'733 2025 Bundesamt für Cybersicherheit BACS
NCSC: voluntary reports, full year 62'954 2024 Bundesamt für Cybersicherheit BACS
NCSC: reports, full year just under 50'000 (calculated 49'380) 2023 Bundesamt für Cybersicherheit BACS (damals NCSC)
NCSC (then the National Cyber Security Centre): reports, full year 34'527 2022 Bundesamt für Cybersicherheit BACS (damals NCSC)
NCSC: reports, full year 21'714 2021 Bundesamt für Cybersicherheit BACS (damals NCSC)
NCSC: reports, 1st half-year 34'789 2024 (H1) Bundesamt für Cybersicherheit BACS
NCSC: reports, 1st half-year 19'049 (calculated) 2023 (H1) Bundesamt für Cybersicherheit BACS
NCSC: reports, 2nd half-year 28'165 2024 (H2) Der Bundesrat / BACS
NCSC: reports, 1st half-year 35'727 2025 (H1) Der Bundesrat / BACS
NCSC: voluntary reports, 2nd half-year 29'006 (plus 145 mandatory reports) 2025 (H2) Bundesamt für Cybersicherheit BACS
NCSC: voluntary reports, 1st half-year 27'128 (plus 200 mandatory reports) 2026 (H1) Bundesamt für Cybersicherheit BACS
NCSC: share of «fraud» in all reports 58% 2025 (H1) Der Bundesrat / BACS
NCSC: share of «fraud» in all reports 52% 2025 (H2) Bundesamt für Cybersicherheit BACS
NCSC: reports of «fraud» 15'090 (H2 2024: 18'269) 2025 (H2) Bundesamt für Cybersicherheit BACS
NCSC: reports of fraud / phishing / spam 10'759 / 8'877 / 3'965 (fraud around 39%) 2026 (H1) Bundesamt für Cybersicherheit BACS
NCSC: shares of reports received (fake calls from authorities / phishing / advertising for online investment fraud) 26% / 19% / 9% 2025 Bundesamt für Cybersicherheit BACS
NCSC: phishing reports via the public reporting form 12'280 (of which 6'299 in H2) 2025 Bundesamt für Cybersicherheit BACS
NCSC: unique phishing URLs (antiphishing.ch) 9'308 2026 (H1) Bundesamt für Cybersicherheit BACS
NCSC: fraudulent threatening calls in the name of authorities 10'578 (H1 2024: 13'730) 2025 (H1) Der Bundesrat / BACS
NCSC: fraudulent threatening calls in the name of authorities 5'941 (H2 2024: 8'173) 2025 (H2) Bundesamt für Cybersicherheit BACS
NCSC: fraudulent threatening calls in the name of authorities 3'817 (−64% compared with H1 2025) 2026 (H1) Bundesamt für Cybersicherheit BACS
NCSC: fake calls from authorities per month after the labelling requirement for mobile numbers (from 01.07.2026) fewer than 100 in July 2026 (Jan.–June 2026: more than 400 per month; −75%) 2026 Der Bundesrat / BACS
NCSC: reports of «advertising for online investment fraud» 3'485 (H1 2024: 729) 2025 (H1) Der Bundesrat / BACS
NCSC: reports of «advertising for online investment fraud» 387 (−89% compared with H1 2025) 2026 (H1) Bundesamt für Cybersicherheit BACS
NCSC: reports of CEO fraud (companies) 970 (2024: 719) 2025 Bundesamt für Cybersicherheit BACS
NCSC: reports of CEO fraud (companies) 484 (2022: 116) 2023 Bundesamt für Cybersicherheit BACS (damals NCSC)
NCSC: reports of CEO fraud 258 (−57% compared with H1 2025) 2026 (H1) Bundesamt für Cybersicherheit BACS
NCSC: reports of invoice manipulation fraud (BEC) 132 (2024: 114; 2023: 118) 2025 Bundesamt für Cybersicherheit BACS
NCSC: reports of invoice manipulation fraud 73 (H1 2025: 59) 2025 (H2) Bundesamt für Cybersicherheit BACS
NCSC: largest individual loss mentioned from invoice manipulation CHF 1.5 million 2025 (H2) Bundesamt für Cybersicherheit BACS
NCSC: voluntary ransomware reports 104 (2024: 92; 2023: 109) 2025 Bundesamt für Cybersicherheit BACS
NCSC: ransomware incidents at Swiss organisations (new counting method including mandatory reporting and partners) 79 (of which 47 voluntary, 10 mandatory reporting, 22 via partners) 2025 (H2) Bundesamt für Cybersicherheit BACS
NCSC: ransomware incidents 79 (same as H2 2025) 2026 (H1) Bundesamt für Cybersicherheit BACS
NCSC: ransomware families active in Switzerland 29 (previously 21); Akira’s share 19% (previously around 35%) 2026 (H1) Bundesamt für Cybersicherheit BACS
NCSC: ratio of reports from the population to those from companies/associations/authorities 90% to 10% 2025 Bundesamt für Cybersicherheit BACS
NCSC: reports of fake sextortion emails 837 (H2 2024: 1'209) 2025 (H2) Bundesamt für Cybersicherheit BACS
NCSC: fraudulent prize draws 1'698 (11% of fraud reports) 2025 (H2) Bundesamt für Cybersicherheit BACS
NCSC: reports from critical infrastructure (mandatory reporting since 01.04.2025), first six months 164 2025 (Apr.–Sep.) Der Bundesrat / BACS
NCSC: mandatory reporting, reports up to the end of the year 221 2025 (Apr.–Dez.) Bundesamt für Cybersicherheit BACS
NCSC: mandatory reporting, type of attack hacking / ransomware just under 26% / around 8% 2026 (H1) Bundesamt für Cybersicherheit BACS
FSO PCS: offences with a digital modus operandi 57'761 (−2.2% compared with 2024) 2025 Bundesamt für Statistik BFS
FSO PCS: offences with a digital modus operandi 59'034 2024 Bundesamt für Statistik BFS
FSO PCS: offences with a digital modus operandi 43'839 2023 Bundesamt für Statistik BFS
FSO PCS: cyber economic crime 54'247 (93.9% of digital offences) 2025 Bundesamt für Statistik BFS
FSO PCS: cyber fraud 39'754 (2024: 42'505; 2023: 30'331) 2025 Bundesamt für Statistik BFS
FSO PCS: misuse of online payment systems/prepaid cards or someone else’s identity for fraud 20'917 (2024: 22'293) 2025 Bundesamt für Statistik BFS
FSO PCS: classified ads platforms, goods not delivered 9'105 (2024: 10'625) 2025 Bundesamt für Statistik BFS
FSO PCS: phishing 7'409 (+25%) 2025 Bundesamt für Statistik BFS
FSO PCS: online investment fraud 2'854 (2024: 2'974) 2025 Bundesamt für Statistik BFS
FSO PCS: fraudulent technical support 1'708 (+9%) 2025 Bundesamt für Statistik BFS
FSO PCS: romance scam 692 (+8%) 2025 Bundesamt für Statistik BFS
FSO PCS: CEO/BEC fraud 560 (+11%) 2025 Bundesamt für Statistik BFS
FSO PCS: sextortion (demand for money) 1'375 (2024: 1'385) 2025 Bundesamt für Statistik BFS
FSO PCS: malware, ransomware (offences reported) 229 (+32%) 2025 Bundesamt für Statistik BFS
FSO PCS: money/package mules 3'875 2025 Bundesamt für Statistik BFS
FSO PCS: clearance rate for digital crime in total 17.6% (2024: 18.6%); cyber economic crime 13.2% 2025 Bundesamt für Statistik BFS
FSO PCS: persons harmed by cyber economic crime 36'572 (of which 81.2% online fraud) 2025 Der Bundesrat / Bundesamt für Statistik BFS
FSO PCS: share of minors among sextortion victims 31.5% 2025 Der Bundesrat / Bundesamt für Statistik BFS
Fribourg cantonal police: reports of fake bank employees since the beginning of the year, of which successful frauds, lossCH (canton of Fribourg) around 750 reports; 130 successful; almost CHF 800'000 in cash plus jewellery and valuables 2026 (bis 13.10.) Kantonspolizei Freiburg
Canton of Vaud: fraud by fake police officers and bank employees since the beginning of the year (cases / successful / loss)CH (canton of Vaud) around 2'300 cases; 900 successful; around CHF 7 million 2026 (01.01.–15.10.) Kanton Waadt (Ministère public)
NCSC: reports of WhatsApp accounts hijacked via fake polls more than 50 2026 (Oktober) Bundesamt für Cybersicherheit BACS
Swiss market: studies and the Swiss Insurance Association (21)
Swiss market: studies and the Swiss Insurance Association, as of 08.11.2026
Key figureValueYearSource
SME study: SMEs (1–49 employees) with a serious cyber incident in the last three years 6% (extrapolated around 35'000 SMEs) 2026 Die Mobiliar
SME study: SMEs that have already been victims of cyber extortion 7% 2026 Netzwoche
SME study: SMEs that expect AI to intensify the threat 81% 2026 Netzwoche
SME study: SMEs that regularly test whether backups can be restored 25% 2026 Die Mobiliar
SME study: SMEs that feel well or very well protected 50% (2025: 42%) 2026 Netzwoche
SME study: SMEs affected by a cyber attack / extorted / lost money through a fraudulent email in the last three years 4% / 5% / 4% 2025 Die Mobiliar
SME study: SMEs that consider their protection sufficient in the event of an attack 42% (2024: 55%) 2025 Die Mobiliar
SME study: SMEs for which cyber security is no longer a priority 28% (previous year 18%) 2025 Die Mobiliar
Deloitte survey: employees in SMEs who have experienced a serious cyber incident at their employer in the last three months 49% (micro businesses: 38%) 2026 Deloitte Schweiz
Deloitte survey: employees who consider their company’s cyber risk to be high 22% (micro businesses: 15%) 2026 Deloitte Schweiz
Share of companies domiciled in Switzerland with cyber insurance 11.5% 2025 Deloitte Schweiz
SIA (Swiss Insurance Association): companies with cyber insurance 72'000 (+7.5%) 2025 blue News (Quelle: Schweizerischer Versicherungsverband SVV)
SIA (Swiss Insurance Association): private cyber policies more than 480'000 (+18%) 2025 blue News (Quelle: Schweizerischer Versicherungsverband SVV)
SIA (Swiss Insurance Association): total cyber insurance premium volume (private individuals / companies) CHF 182 million (+5.8%); private individuals CHF 29 million (+21%), companies CHF 153 million (+3.4%) 2025 blue News (Quelle: Schweizerischer Versicherungsverband SVV)
SIA (Swiss Insurance Association): cyber insurance premium volume around CHF 172 million (+22%) 2024 Netzwoche (Quelle: SVV via Swissinfo)
SIA (Swiss Insurance Association): insurance penetration of SMEs vs. large corporations SMEs 5–10%, large corporations around 50% 2024 Netzwoche (Quelle: SVV via Swissinfo)
Valais cantonal police: cases and attempts of telephone fraud (fake police officers, bank or company employees) in one weekCH (canton of Valais) almost 30; loss around CHF 150'000 2026 (Woche bis 22.09.) RTS (gestützt auf Kantonspolizei Wallis)
Basel-Landschaft police: losses from fake bank employees (remote access, e.g. AnyDesk) in the last six monthsCH (canton of Basel-Landschaft) more than CHF 1.15 million 2026 (Halbjahr bis Mai) Polizei.news (gestützt auf Polizei Basel-Landschaft)
Check Point: cyber attacks per week and organisation in Switzerland 1'928 (same month of the previous year 971, around +99%); Europe 2'545 2026 (September) Netzwoche (gestützt auf Check Point)
Bitdefender: publicly claimed ransomware victims in Switzerland 35 (rank 20 worldwide); in March, 11; production and healthcare 7 each 2026 (H1) inside-it.ch (gestützt auf Bitdefender)
swissVR Monitor: companies that, according to board members, have already been victims of a cyber attack 41% (2023: 28%); SMEs 37% (2023: 20%); large companies 48% (2023: 45%) 2026 Deloitte Schweiz
International (47)
International, as of 08.11.2026
Key figureValueYearSource
IBM: average cost of a data breach worldwideglobal USD 4.44 million (first decrease in five years) 2025 IBM / Ponemon Institute
IBM: average cost of a data breach in the USAUSA USD 10.22 million (record) 2025 IBM / Ponemon Institute
IBM: organisations with a breach of AI models/applications; of these, without AI access controlsglobal 13%; of these 97% 2025 IBM / Ponemon Institute
IBM: organisations with a breach due to shadow AI; additional costs with high use of shadow AIglobal 1 in 5; +USD 670'000 2025 IBM / Ponemon Institute
IBM: share of data breaches in which attackers used AI toolsglobal 16% (mostly phishing, deepfake impersonation) 2025 IBM / Ponemon Institute
IBM: average cost of a data breach worldwideglobal USD 4.99 million (+12%, record) 2026 IBM / Ponemon Institute
IBM: AI-assisted malicious data breaches (share, costs)global 1 in 4 (+56%), avg. USD 6 million 2026 IBM / Ponemon Institute
IBM: shadow AI in data breachesglobal 43% (2025: 20%), avg. USD 5.39 million 2026 Baker Donelson (Anwaltskanzlei)
IBM: share of organisations with a ransomware incidentglobal 39% (previous year 34%) 2026 IBM / Ponemon Institute
Sophos: share of ransomware victims who paid the ransomglobal 49% (2024: 56%) 2025 Sophos
Sophos: median ransom paidglobal USD 1 million 2025 Sophos
Sophos: average recovery costs excluding ransomglobal USD 1.53 million (2024: USD 2.73 million) 2025 Sophos
Sophos: main points of entry (victims’ self-assessment)global vulnerabilities 32%, compromised login data 23%, malicious email 19%, phishing 18% 2025 Sophos
Sophos: median ransom paid / clean-up costsglobal USD 769'000 / USD 1.7 million 2026 Sophos
Verizon DBIR: share of ransomware in data breachesglobal 44% (previous year 32%) 2025 Verizon
Verizon DBIR: ransomware in data breaches at SMEsglobal 88% (large companies 39%) 2025 Verizon
Verizon DBIR: share of ransomware in data breachesglobal 48% (previous year 44%) 2026 Verizon Business
Verizon DBIR: ransomware victims who did not pay; median ransomglobal 69%; USD 139'875 2026 Verizon Business
Verizon DBIR: data breaches involving third partiesglobal 48% (+60%) 2026 Verizon Business
Verizon DBIR: exploitation of vulnerabilities as initial accessglobal 31% (misuse of login data 13%) 2026 Verizon Business
Verizon DBIR: SME data breaches; initial accessglobal 7'152 confirmed cases; vulnerabilities 26%, login data 13%, phishing 9%; third parties 55% 2026 Verizon Business
Verizon DBIR: employees who regularly use AI on company devicesglobal 45% (previous year 15%) 2026 Verizon Business
Hiscox: share of SMEs with a cyber attack in the last 12 months7 countries (Europe/USA) 59% (DE 67%, UK 65%); 27% of those attacked with ransomware 2025 Hiscox
Coveware: share of ransomware cases with ransom paymentglobal 23% (historic low) 2025 (Q3) Coveware by Veeam
Coveware: median / average ransom paymentglobal USD 150'000 / USD 1'880'612 2026 (Q2) Coveware by Veeam
Coveware: median / average ransom payment; cases without paymentglobal USD 400'000 / USD 1'025'278; almost 80% without payment 2026 (Q3) Coveware by Veeam
Chainalysis: ransomware payments on-chainglobal more than USD 820 million (2024 revised: 892 million; −8%) 2025 Chainalysis
FBI IC3: reported losses from internet crime in totalUSA USD 20.877 billion (+26%), 1'008'597 complaints 2025 FBI Internet Crime Complaint Center (IC3)
FBI IC3: losses from business email compromise (BEC)USA USD 3.047 billion (24'768 complaints) 2025 FBI Internet Crime Complaint Center (IC3)
FBI IC3: complaints and losses of persons aged 60 and overUSA 201'266 complaints (+37%), USD 7.748 billion (+59%) 2025 FBI Internet Crime Complaint Center (IC3)
FBI IC3: complaints and losses with an AI connection (reported for the first time)USA 22'364 complaints, USD 893 million 2025 FBI Internet Crime Complaint Center (IC3)
BKA: cybercrime offences (including offences committed abroad)DE 333'922 (offences abroad 207'888, domestic offences 126'034) 2025 IHK Schwerin (Quelle: Bundeskriminalamt BKA)
BKA: ransomware attacks reportedDE 1'041 (+10%); 90% SMEs; 7% paid; around USD 15.5 million in ransom 2025 IHK Schwerin (Quelle: Bundeskriminalamt BKA)
Bitkom: losses from data theft, espionage and sabotage in the German economyDE at least 211 billion euros (range up to 270.8 billion); 2025: 289.2; 2024: 266.6 2026 Bitkom e.V. / Bitkom Research
Bitkom: share of cyber attacks in total lossesDE 76% (2024: 67%) 2026 Bitkom e.V. / Bitkom Research
Bitkom: companies that observe increased use of AI in attacks (certain / suspected)DE 31% / 51% 2026 Bitkom e.V. / Bitkom Research
Munich Re: global cyber insurance premium volumeglobal just under USD 15 billion 2025 Munich Re
Allianz Risk Barometer: rank of cyber incidents / AI among global business risksglobal Rank 1 / rank 2 (AI previously rank 10) 2026 Allianz Commercial
ENISA: share of phishing in initial access; AI-assisted phishing in social engineering activityEU around 60%; more than 80% (beginning of 2025, «reportedly») 2025 ENISA (EU-Agentur für Cybersicherheit)
CrowdStrike: increase in voice phishing (vishing) H2 vs. H1 2024; average eCrime breakout timeglobal +442%; 48 minutes (fastest 51 seconds) 2024 CrowdStrike
CrowdStrike: average / fastest eCrime breakout time; attacks by AI-assisted actorsglobal 29 minutes / 27 seconds; +89% 2025 CrowdStrike
Microsoft MDDR: attacks with an extortion component / ransomware or destructiveglobal 33% / 19% 2025 Microsoft
Deloitte forecast: fraud losses enabled by generative AI in the USAUSA USD 40 billion by 2027 (2023: 12.3 billion; 32% p.a.) Prognose 2027 Deloitte Center for Financial Services (USA)
Anthropic: AI-orchestrated espionage campaign, targets / share of work done by AIglobal around 30 organisations / 80–90% 2025 Anthropic
Anthropic: «vibe hacking» data extortion with Claude Codeglobal at least 17 organisations, ransom demands in some cases more than USD 500'000 2025 Anthropic
Refrigeration wave: supermarket branches affected in France (Intermarché, Carrefour, plus Coopérative U without a figure)FR more than 230 (around 150 Intermarché, 80 Carrefour) 2026 (Oktober) heise online
Refrigeration wave: value of destroyed food in BelgiumBE around EUR 100'000 (around 60 branches of Delhaize, Carrefour, Spar) 2026 (Oktober/November) heise online

Three ways forward