Name: BACS reports and ransomware cases in Switzerland, CW 35/2026
Creator: n'guard Cyber Security
License: https://creativecommons.org/licenses/by/4.0/

n'guard assessment of this week

The threat situation has worsened markedly this week: with 1’346 BACS reports and a 51 per cent rise in fraud attempts on the previous week, fraud campaigns targeting financial transactions are surging. At the same time, phishing remains the second most frequent problem with 497 reports, while ransomware attacks on Swiss companies pose a considerable risk, with 98 documented cases year on year. The technology sector in particular has repeatedly been targeted in recent weeks by groups such as THEGENTLEMEN and SHINYHUNTERS. You should step up staff awareness of fraud patterns and review how payment orders are authenticated.

The key points in brief

Summary of the week.

Summary

The Swiss cyber threat landscape in calendar week 35/2026: the Federal Office for Cybersecurity (BACS) received 1’346 reports of cyber incidents. The most frequent category was fraud attempts, with 528 reports (+51% on the previous week). Over the past twelve months, 98 Swiss ransomware victims have been made public.

Reported incidents by category.

All reports received by the BACS in calendar week 35/2026, with the change on the previous week.

Fraud attempts

528

+51%

Phishing

497

+1%

Spam

158

+22%

Cybersquatting

−26%

Hacking

−13%

Malware

+0%

Bar length is relative to the most frequently reported category of the week. These are reports received by the BACS, not necessarily successful attacks.

Ransomware

Most recently disclosed cases with a Swiss connection.

Victims that have become publicly visible on leak sites, not the total number of incidents in Switzerland.
Disclosed	Sector	Group
01.09.2026	Professional Services	KRYBIT
30.08.2026	Technology	THEGENTLEMEN
22.08.2026	Other	INCRANSOM
20.08.2026	Technology	PAYLOAD
18.08.2026	Technology	SHINYHUNTERS
14.08.2026	Professional Services	THEGENTLEMEN

Methodology and sources

The data is based exclusively on publicly available sources: the reporting statistics published weekly by the Swiss Federal Office for Cybersecurity (BACS) and publicly disclosed ransomware cases via ransomware.live. n'guard does not collect its own reporting figures. Instead, it aggregates this data, puts it into context and translates it into actionable recommendations.

The figures reflect the number of cyber incidents reported, not the actual total in Switzerland. The number of unreported cases is likely to be higher for technically more sophisticated attacks than for widely recognised fraud schemes. This report contains no confidential or access-restricted information (TLP:CLEAR) and may be freely reused with attribution.

Suggested citation: n'guard Cyber Security: Weekly Cyber Report, calendar week 35/2026. Available at https://nguard.swiss/cyber-weekly-report/kw-35-2026/

How vulnerable is your company really?

In four minutes, the n'guard Security Quick Check gives you a well-founded, anonymous assessment of your attack surface, with concrete recommendations and no registration.

Start the Security Quick Check