455 security breach reports in Switzerland in 2026

Context

TL;DR

• 455 reports of breaches in 2026
• 343 reports throughout 2025
• Federal investigation into an external IT provider
• Possible extension to federal entities and pension funds

Key facts

• Reports 2026: 455
• Reports 2025: 343 throughout the year
• Authority: FDPIC, Adrian Lobsiger
• Investigation: launched last week
• Current focus: external IT provider

BERN — During 2026, the Federal Data Protection and Information Commissioner (FDPIC) has already received 455 reports of data-security breaches in Switzerland. Adrian Lobsiger stated this in an interview with Sonntagsblick.

The comparison given in the source is with the 343 reports recorded throughout 2025. However, the text specifies that the actual number of incidents would be significantly higher because a large number of cases go unreported. The 455 reports therefore represent what reached the authority, not the total number of incidents that occurred.

The investigation into pension funds

After a cyberattack on a company that provides software to several Swiss pension funds, the FDPIC opened a formal investigation last week. The proceedings currently concern the external IT provider. Lobsiger did not rule out that it could later be extended to federal institutions and pension funds.

The source distinguishes between the data already collected and the investigation that is still open. The extension is not described as a decision that has been made, but as a possibility not ruled out by the Commissioner. For reasons related to investigative secrecy, Lobsiger was unable to provide further details about the specific case.

The issue of data management

Beyond the specific incident, the FDPIC warned that linking data and removing barriers between silos can increase the risk of data-security breaches. The authority indicated two precautions: transmit only the data that are strictly necessary and preferably work with anonymized test data.

This statement does not attribute a breach to the provider and does not identify the cause of the attack on the pension funds. Instead, it links the risk to the way data are interconnected, transmitted and used in testing. The source does not say which of these elements are present in the case examined by the FDPIC; the connection therefore remains a general warning, not a finding in the proceedings.

Operational details

The comparison enabled by the data

The number of reports requires precise interpretation, because the two time bases do not coincide. In 2025, the count covers the entire year; for 2026, the source says that 455 reports had already been received during the year. The 2026 total has therefore exceeded that of 2025, but the text does not present the two figures as equivalent periods.

The arithmetic difference is 112 reports. Relative to the 343 for all of 2025, this amounts to approximately 33%. This is a calculation based on the reported figures, not a percentage announced by the IFPDT. It does not make it possible to turn the figure into a forecast for the end of 2026, because the source does not specify what portion of the year is covered by the 455 reports.

An increase not to be overinterpreted

There is also a second limitation. The IFPDT points out that many cases are not reported and that the actual number of incidents would be significantly higher. Reports are therefore a measure of incidents communicated to the authority; the text does not provide the number of cases left out of the count. It is therefore not possible to derive the total number of breaches from the 455 and 343 alone, nor to determine how much underreporting weighs in the comparison between the two periods.

This distinction also avoids an undocumented causal link. The source presents the increase in reports and the attack on the pension funds' software provider in the same context, but it does not state that this incident is included in the 455, that it caused the 2025 figure to be exceeded, or that it explains a specific share of the increase.

Two different levels

The first element is therefore aggregate: reports received by the IFPDT in Switzerland. The second is specific: a formal investigation launched after an attack against a software provider for several pension funds. The verifiable relationship between the two is only the one indicated by the text: the second fact led to the opening of the investigation, while the first describes the volume of reports. Separating the two levels makes it possible to read the figures without turning them into an explanation of the specific case.

Key points

Digital threat and responsibility still to be clarified

In the interview, Lobsiger described the threat posed by artificial intelligence as “real.” In the same passage, however, he distinguished the technological threat from the analysis of causes: in the vast majority of reported attacks, he stated, the weak point is not technology but human error.

The two statements describe different aspects. The first is an assessment of the threat posed by artificial intelligence; the second concerns what emerges from the analysis of the causes of attacks already reported. The source does not say that artificial intelligence was used in the attack on the pension fund provider. Nor does it say that, in that case, the weak point was human error. Attributing either cause to the proceedings currently underway would go beyond the available information.

The investigation phase

The situation regarding responsibility also remains open. For now, the formal investigation is directed against the external IT provider. Lobsiger did not rule out extending it to federal bodies and pension funds, but the text does not present this possibility as a decision already adopted. Investigative secrecy also prevents further details about the specific case from being known.

The source does not indicate what data were involved, how many pension funds were affected, or what the outcome of the attack was. It does not report the outcome of the investigation or any sanctions. These omissions make it impossible to measure the concrete impact of the incident and do not justify identifying responsible parties beyond the current scope of the proceedings.

What is established

Three elements remain verifiable. The first is the volume of reports submitted to the IFPDT and the fact that the actual number of cases is considered higher because of the presence of unreported cases. The second is the opening of a federal investigation following an attack on a software provider for several Swiss pension funds. The third is the warning from the IFPDT about the greater exposure associated with interconnected data, together with its preference for anonymized test data.

These elements create a national picture of data security, but not a complete reconstruction of the attack. The statistical data, the general assessment of artificial intelligence, the human error identified in the majority of reported cases, and the responsibility still under investigation remain separate. This separation, more than the numbers taken in isolation, defines what the source currently allows us to state.

Source: tio.ch