The Federal Data Protection and Information Commissioner (FDPIC), Adrian Lobsiger, has received 455 reports of data security breaches since the start of 2026. He said so in an interview with the German-language Swiss weekly SonntagsBlick, reported on 25 October 2026 by the Keystone-SDA news agency and SWI swissinfo.ch. For the whole of 2025, the Commissioner counted 343. In his view, the actual number of data breaches in Switzerland is probably much higher.
What the Commissioner announced on 25 October 2026
The figure of 455 covers the reports received since 1 January 2026, up to the interview published on 25 October. The year is therefore not over, and the total already exceeds that of 2025.
Adrian Lobsiger immediately qualifies this figure. He believes that many cases are never reported to him. The 455 reports therefore measure what lands on his desk, not all incidents.
The interview comes a few days after a closely followed case. The Commissioner has opened a formal investigation into PK Softech, the software provider of several Swiss pension funds. For now, the investigation targets this external IT service provider.
Adrian Lobsiger does not rule out extending it later to federal bodies and pension funds. He gave no further details, citing the confidentiality of the investigation.
How should these 455 reports be put in context?
The comparison with 2025 shows a clear increase. Both figures come from the Commissioner, quoted by Keystone-SDA.
| Period | Breach reports received by the FDPIC |
|---|---|
| Full year 2025 | 343 |
| 2026, up to the interview published on 25 October | 455 |
Our calculation: even before the end of the year, 2026 has 112 more reports than the whole of 2025. The increase therefore already exceeds 30%, with two months still to go.
The sources consulted do not give figures for the years before 2025. They therefore do not show whether the trend is older.
What the figure does not say
A report is not an attack. The figure counts reports received, not confirmed incidents or their severity.
Several explanations remain possible, and our sources do not decide between them:
- more actual incidents;
- organisations reporting their incidents more often;
- serial attacks, where a single affected service provider leads to several reports.
Our analysis: this last mechanism is far from theoretical. At the end of September 2026, the attack on a software provider hit the Zurich pension fund, and the Swiss Post pension fund said it was also affected. A single weak point can thus generate several cases at the Commissioner's office.
Who reports a data breach, and to whom?
In Switzerland, two federal offices receive reports, with different roles. The Commissioner deals with the protection of personal data. The Federal Office for Cybersecurity (FOCS) handles cyber incidents from a technical standpoint.
Recent cases illustrate the first channel. PK Softech itself reported the attack to the Commissioner on 8 October 2026. The online magazine Republik also reported the theft of its users' data to the Commissioner.
The second channel goes through the FOCS. For an SME, reporting to this office remains voluntary. Since 1 April 2025, however, operators of critical infrastructure must report their cyber incidents to it.
Our analysis: a single attack can therefore involve both offices. The FOCS helps contain the incident, while the Commissioner examines what happened to the personal data.
Why breaches are multiplying, according to the Commissioner
Adrian Lobsiger points first to a human factor. According to him, analysing the causes of the reported attacks shows that the weak point is rarely the technology. In the vast majority of cases, it is human error.
The Commissioner also describes the threat linked to artificial intelligence (AI) as “real”. He does not, however, place it at the top of the causes observed.
Finally, his office highlights an organisational risk. The interconnection of data and the removal of data silos increase, in his view, the risk of security breaches.
What this means for an SME in Switzerland
The Commissioner's recommendations translate into concrete steps. He asks that only strictly necessary data be transmitted. He also recommends working preferably with anonymised test data.
Our analysis: these two pieces of advice directly target exchanges with service providers. An SME that entrusts a customer file to a supplier can ask itself what it is really sending, and whether dummy data would be enough.
The human error highlighted by the Commissioner ties in with basic IT security measures: training the team to spot phishing, protecting access, keeping emergency contacts up to date. According to the 2026 SME cybersecurity study, only about a third of SMEs train their staff regularly.
What we don't know yet
- The breakdown of the 455 reports by sector, size of organisation or type of incident: the interview does not provide it.
- Figures for the years before 2025, which would put the increase in context over a longer period.
- The share of reports linked to a single serial attack, such as the one that targeted the pension funds.
- The extent of unreported cases: the Commissioner considers it significant, without putting a figure on it.
- The exact criteria and deadline set by the Data Protection Act (nFADP) for reporting a breach: the sources consulted for this article do not detail them.
