Cybersecurity: 1.587 reports in one week

Context

TL;DR

• 1.587 voluntary reports in one week
• New high since at least the beginning of 2025
• 41% of companies surveyed by Deloitte have suffered an attack
• 280 notifications involving critical infrastructure from January to August

Key facts

• Authority → Federal Office for Cybersecurity (UFCS)
• Record reports → 1.587 in one week
• Previous record → 1.353, one month earlier
• Notification obligation → in force since April 2025
• Deloitte study → 281 board members; 41% of companies affected

In the past week, the Federal Office for Cybersecurity (UFCS) recorded 1.587 voluntary reports, the highest weekly figure at least since the beginning of 2025. This figure exceeds the previous record, which stood at 1.353 reports and had been reached just one month earlier, by more than 17%.

The figure comes in a Swiss context marked by attacks targeting the online platform Ricardo, the federal pension fund Publica, and the aerospace company Beyond Gravity. Distinct from one another, these incidents have brought the cybersecurity of companies and institutions back into the spotlight.

The record does not equate to damage

The majority of reports received by the UFCS concern phishing attempts, scams and unsolicited messages. For this reason, the record cannot be read as a count of successful attacks: not all reports correspond to successful cyberattacks or incidents that caused damage.

Between January and August, the UFCS recorded 280 reports of cyber incidents in critical infrastructures subject to the notification obligation. In the April–August period, there were 173 reports, compared with the 104 recorded in the same period of the previous year. The notification obligation has been in force since April 2025.

An additional indicator is provided by a Deloitte study released in mid-September, based on interviews with 281 members of the boards of directors of small, medium-sized and large companies. The survey found that 41% of the companies involved had already suffered a cyberattack: compared with three years ago, the share has increased by 13 percentage points. Anyone consulting aziende che assumono will therefore find different information: here, cyber exposure is measured, not seat availability.

Raphael Hauser, Abraxas's head of cybersecurity, argues that cybercriminals are increasingly combining vulnerabilities in widely used software, stolen login credentials and techniques for manipulating employees. The expert discussed this at the beginning of October in an interview with the specialized portal Swisscybersecurity.net. Experts also warn that artificial intelligence could further facilitate attacks.

Operational details

How to read the data

The first useful data point for anyone working at a Swiss company is the distinction between an alert and a successful attack. A phishing message or a scam can generate a report even when it causes no damage. The increase in reports therefore describes the events that came to the authority's attention; on its own, it does not make it possible to calculate how many systems were compromised. This distinction prevents a statistical peak from automatically becoming a measure of losses.

Three indicators, three interpretations

| Indicator | Correct interpretation | Limitation of the data | | Voluntary reports | Include phishing, scams and unwanted messages | Are not equivalent to successful attacks | | Critical infrastructure | Concern incidents subject to mandatory notification | Do not represent every threat to companies | | Deloitte survey | Covers companies that report having suffered an attack | Does not quantify the economic damage |

The second point concerns critical infrastructure. The series of incidents subject to notification and that of voluntary reports should not be added together automatically to obtain a total number of attacks in Switzerland: they describe different categories. For a board of directors, this distinction is crucial when comparing internal alerts with public data.

The same caution is needed for the Deloitte survey. The percentage recorded measures the experience reported by the companies involved, not the weekly number of reports received by the UFCS. The sample includes members of the boards of directors of small, medium-sized and large companies; the result describes a proportion of exposed companies, not the flow of incidents reported to the authority.

Raphael Hauser's analysis adds an operational element: vulnerabilities in widely used software, stolen credentials and the manipulation of employees can be exploited together. In a generic scenario, the visible message may be just one step in a broader chain. This does not make it possible to automatically attribute all vectors to a single case.

Finally, artificial intelligence introduces a forward-looking warning. Experts indicate that it could make attacks easier to carry out. For those consulting annunci di lavoro, the topic therefore remains distinct from employment: here, the cyber exposure of companies is measured.

Recommended tools

For an updated estimate, use the net salary calculator and the CHF-EUR exchange comparator.

Useful tools to protect your net income

To reduce FX leakage, compare CHF-EUR exchange options and banks for cross-border workers.

Key points

From reading to action

The source information enables a cautious operational sequence, without conflating different categories. The starting point is not the absolute number of reports, but the nature of the signal and the technical or human vector described by the experts.

Four steps for a company

1. Classify the event. Separate phishing, scams and unwanted messages from a successful cyberattack. The distinction prevents every alert from being considered already confirmed damage.

2. Examine the combination. Review the three elements identified by Raphael Hauser: vulnerabilities in widely used software, stolen access credentials and employee manipulation. They are described as tools used with increasing frequency and combined with one another. The review must therefore remain broad, without attributing an unproven vector to a single incident.

3. Establish the reporting regime. If the activity falls within critical infrastructure, keep incidents subject to the notification requirement separate from voluntary reports received by the UFCS. The relevant point in time to consider is April 2025, when the requirement came into force.

4. Consider artificial intelligence. The experts warn that it can make attacks easier to carry out. It should therefore be treated as a factor to monitor, not as proof that an attack has already occurred.

For management, the Deloitte survey can serve as an external benchmark for companies' exposure. However, it does not replace an examination of the individual case: a percentage reported by members of boards of directors and a report received by the UFCS belong to different levels. Internal records should keep at least the type of message, the presence of a successful attack and any connection to critical infrastructure separate. This framework follows the distinctions provided by the source without adding a technical procedure not described there.

The timeline also needs to be read correctly. The record for one week, the series of incidents subject to notification and the survey published in mid-September have different observation periods. Comparing them as though they were the same indicator would lead to an incorrect conclusion.

To complete the picture of Swiss work, use calcolatore stipendio.

Source: tio.ch