n'guard Cyber Security TLP:CLEAR
Weekly Cyber Report · Calendar week 45/2026

Cyber threat landscape
Switzerland.

The week's reporting figures from public Swiss statistics, aggregated, put into context and prepared for decision-makers.

Published: 10.11.2026 Source: BACS · ransomware.live Free to use with attribution
View all editions
1’364
Reports to the BACS in calendar week 45
+16%
Phishing, change on previous week
107
Swiss ransomware victims, last twelve months
n'guard assessment of this week

The threat situation worsens markedly this week: with 1’364 BACS reports, we are seeing a sharp rise in phishing, up 16 per cent to 600 cases, and, particularly worrying, in fraud attempts, up 33 per cent to 429 reports. The five current ransomware incidents show that several groups are active in parallel, with THEGENTLEMEN and AKIRA specifically targeting companies in manufacturing and trade.

The key points in brief

Summary of the week.

Summary

The Swiss cyber threat landscape in calendar week 45/2026: the Federal Office for Cybersecurity (BACS) received 1’364 reports of cyber incidents. The most common category was phishing with 600 reports (+16% on the previous week). Over the last twelve months, 107 Swiss ransomware victims have been made public.

Categories

Reported incidents by category.

All reports received by the BACS in calendar week 45/2026, with change on the previous week.

Phishing
600
+16%
Fraud attempts
429
+32%
Spam
158
−19%
Hacking
21
−52%
Cybersquatting
21
+24%
False positive
17
−39%

Bar length is relative to the most frequently reported category of the week. These are reports received by the BACS, not necessarily successful attacks.

Ransomware

Most recently disclosed cases with a Swiss connection.

Victims that have become publicly visible on leak sites, not the total number of incidents in Switzerland.
DisclosedSectorGroup
12.11.2026 Other INCRANSOM
07.11.2026 Financial Services RHYSIDA
05.11.2026 Technology THEGENTLEMEN
05.11.2026 Manufacturing THEGENTLEMEN
04.11.2026 Retail & E-Commerce MEDUSALOCKER
04.11.2026 Manufacturing AKIRA

Methodology and sources

The data is based exclusively on publicly available sources: the reporting statistics published weekly by the Swiss Federal Office for Cybersecurity (BACS) and publicly disclosed ransomware cases via ransomware.live. n'guard does not collect its own reporting figures. Instead, it aggregates this data, puts it into context and translates it into actionable recommendations.

The figures reflect the number of cyber incidents reported, not the actual total in Switzerland. The number of unreported cases is likely to be higher for technically more sophisticated attacks than for widely recognised fraud schemes. This report contains no confidential or access-restricted information (TLP:CLEAR) and may be freely reused with attribution.

Suggested citation: n'guard Cyber Security: Weekly Cyber Report, calendar week 45/2026. Available at https://nguard.swiss/cyber-weekly-report/kw-45-2026/

How vulnerable is your company really?

In four minutes, the n'guard Security Quick Check gives you a well-founded, anonymous assessment of your attack surface, with concrete recommendations and no registration.

Start the Security Quick Check