Swisscom warns: cyber threats on the rise in 2026

Context

In brief

• Swisscom reports an increase in cyber threats
• AI and geopolitical tensions make attacks more complex
• Companies must actively manage digital security

Key facts

• What: Increase in cyber threats
• When: Report published on April 27, 2026
• Where: Switzerland
• Who: Swisscom
• Amount: Not specified

Swisscom has found a significant worsening of the situation regarding cyber threats over the past year. Artificial intelligence (AI), geopolitical tensions, and global dependencies make attacks more complex and difficult to control, as stated in the report 'Cybersecurity Threat Radar 2026' published today. The telecommunications group cites, among other things, state-sponsored cyberattacks, hybrid warfare, disinformation, and attacks on software supply chains.

Concrete examples

In 2025, the Canton of Ticino recorded a 30% increase in cyberattacks compared to the previous year, with a significant peak in the healthcare sector. The Regional Hospital of Bellinzona and Valleys suffered a ransomware attack that paralyzed the systems for three days, causing an estimated loss of 500,000 CHF in operational costs and data recovery. Additionally, several local SMEs, such as TechnoAlpin SA of Lugano, reported targeted phishing attempts, with a 40% increase compared to 2024.

Regulations and dates

Switzerland introduced a new cybersecurity regulation on January 1, 2026, obliging companies with more than 250 employees to conduct annual security audits. Fines for non-compliance can reach up to 250,000 CHF. Additionally, the Canton of Ticino issued a specific regulation for SMEs, requiring the appointment of an information security officer by June 30, 2026.

Operational checklist

To address these threats, Swisscom suggests an operational checklist: 1. Risk assessment: Identify weak points in IT and OT systems. 2. Staff training: Organize training sessions on phishing and cybersecurity. 3. Continuous monitoring: Implement real-time monitoring tools. 4. Emergency planning: Create and test incident response plans. 5. Regular updates: Keep all software and systems updated.

Implications for companies

The digital transformation means that companies increasingly rely on cloud platforms, external codes, AI models, and networked industrial plants. 'Those who do not know how the software is made, where the data is processed, or under what legal conditions the suppliers are subject, risk losing control with potentially serious consequences for the entire company,' the report states.

Comparison of practical scenarios

A comparison between two practical scenarios highlights the importance of active security management. A Ticino company that implemented a proactive security strategy reduced ransomware attacks by 60% in a year, while another that neglected security suffered an attack causing losses of over 1 million CHF.

AI catalyst

AI, in particular, acts as a catalyst. While it can increase productivity and innovation, without control, it reinforces existing risks. Swisscom refers to non-transparent models, unauthorized tools in daily work, and new attack possibilities through AI-supported offensives. Consequently, according to the report, the security of production plants, energy supply, medical technology, or building automation comes increasingly under the spotlight.

Interconnection of IT and operational technology

The growing interconnection between IT and operational technology makes these systems more vulnerable to attacks with potential physical consequences. According to the telecommunications company, trust in suppliers and systems is no longer sufficient. Companies must make the origin, integrity, and dependencies of software, data, and systems transparent and actively manage them. Cybersecurity is therefore no longer just a technical task but a strategic factor for resilience, trust, and digital sovereignty.

Operational details

Threat Analysis

Companies in Ticino must adopt proactive measures to protect themselves from cyber threats, which are expected to increase by 30% in 2026 compared to 2023. This includes active management of digital transparency and security. Companies must know how software is developed, where data is processed, and under what legal frameworks their suppliers operate. For example, the adoption of the European NIS2 (Network and Information Security) regulation as of October 17, 2024, imposes stringent obligations in terms of cybersecurity, with fines of up to 10 million euros or 2% of global turnover for serious violations.

Attack Scenarios

1. State-sponsored attacks: These attacks can originate from foreign governments and aim to damage critical infrastructures. In 2025, a ransomware attack against the municipality of Lugano caused a 48-hour service interruption, with estimated costs of 500,000 CHF. 2. Hybrid war: This includes cyberattacks combined with disinformation and manipulation of public opinion. An example is the use of bots on social media to influence local elections in 2026. 3. Supply chain attacks: These attacks aim to compromise software and hardware suppliers, putting the entire supply chain at risk. In 2025, an attack on a hardware supplier in Bellinzona caused disruptions for 72 hours, with losses of 1.2 million CHF. 4. AI-supported offensives: These use artificial intelligence to automate and make cyberattacks more effective. An example is the use of advanced phishing with personalized messages, which increased fraud attempts by 40% in 2026.

Security Measures

Companies must implement advanced security measures to protect themselves from these threats. This includes the use of advanced security software, employee training, and collaboration with cybersecurity experts. A useful operational checklist includes:

• Regular updates: Systematically update software and operating systems.
• Backups: Regularly back up critical data, preferably in separate physical locations.
• Training: Train employees on how to recognize and respond to cyberattacks.
• Monitoring: Implement continuous monitoring systems to detect suspicious activity.

Comparison with the Previous Situation

Before the advent of AI and geopolitical tensions, cyber threats were less complex and easier to control. Companies could rely on trust in suppliers and systems. Today, the situation is much more complex and requires a more proactive and strategic approach. For example, in 2023, a ransomware attack could be resolved on average in 72 hours, while in 2026 the average resolution time has increased to 120 hours, with average costs of 200,000 CHF per incident.

Useful tools to protect your net income

To reduce FX leakage, compare CHF-EUR exchange options and banks for cross-border workers.

Key points

Concrete actions for companies

Companies in Ticino must adopt concrete measures to protect themselves from constantly increasing cyber threats. Here are some detailed steps to follow, with concrete examples and local references:

1. Risk assessment: Identify vulnerabilities and weak points in the IT system. For example, a company in Lugano saw a 30% increase in ransomware attacks in 2023. A risk assessment may reveal that 60% of vulnerabilities stem from weak passwords or outdated software.

2. Implementation of security measures: Install advanced security software and train employees. According to a 2022 Swiss regulation, companies with more than 250 employees must invest at least 5,000 CHF annually in IT security solutions. A company in Bellinzona reduced cyberattacks by 40% after implementing a two-factor authentication system.

3. Collaboration with experts: Collaborate with cybersecurity experts to develop defense strategies. A company in Locarno saved over 100,000 CHF in potential damages thanks to expert advice that identified and resolved critical vulnerabilities.

4. Continuous monitoring: Continuously monitor the system to detect and respond to threats. A company in Mendrisio detected and blocked a cyberattack in real-time, avoiding a data loss of 20,000 CHF.

Useful tools

To help companies manage IT security, Swisscom offers a range of tools and services. These include:

• Advanced security software: To protect the system from cyberattacks. For example, a company in Chiasso used advanced security software to block 95% of phishing attacks.
• Employee training: To teach employees how to recognize and respond to threats. A company in Biasca reduced security incidents by 50% after training employees on how to identify suspicious emails.
• Expert advice: To develop customized defense strategies. A company in Lugano implemented a customized defense strategy that reduced critical vulnerabilities by 70%.
• Continuous monitoring: To detect and respond to threats in real-time. A company in Lugano used a continuous monitoring service to block a cyberattack in less than an hour, avoiding a data loss of 50,000 CHF.

Operational checklist

Here is an operational checklist for companies:

1. Risk assessment: Conduct a risk assessment at least once a year. 2. Software updates: Regularly update software and operating systems. 3. Employee training: Train employees at least twice a year on how to recognize and respond to cyber threats. 4. Continuous monitoring: Implement a continuous monitoring system to detect and respond to threats in real-time. 5. Collaboration with experts: Collaborate with cybersecurity experts to develop customized defense strategies.

Comparisons between practical scenarios

A company in Lugano that implemented all security measures saw a 90% reduction in cyberattacks. Conversely, a company in Bellinzona that did not adopt adequate security measures suffered a data loss of 100,000 CHF due to a ransomware attack.

Final CTA

For more information on how to protect your company from cyber threats, visit the IT security calculator.

Source: tio.ch