Ransomware encrypts a company's data, often after copying it, then demands a ransom to release it. In Switzerland, the Federal Office for Cybersecurity (FOCS) received 57 such reports in the second half of 2025, according to its semi-annual report of 30 March 2026. In the event of an attack, the office recommends immediately isolating the affected systems, filing a criminal complaint and not paying.

How does a ransomware attack work?

According to the FOCS "Ransomware" page, this malicious software encrypts the files on the infected computer, but also those on the network drives connected to it. The perpetrators then demand a ransom to restore access to the data. The damage becomes considerable when the backup copies are also affected, the office points out.

The lockout is often accompanied by blackmail over stolen data. The joint press release of 16 October 2025 from the Office of the Attorney General of Switzerland (OAG), the Federal Office of Police (fedpol) and the FOCS describes this "double extortion" in connection with the Akira group. The hackers first copy the victim's data, then encrypt it. If the ransom is not paid by the set deadline, they publish the data on a leak site hosted on the darknet, known as a DLS (Data Leak Site). Payment is demanded in cryptocurrency, most often in bitcoin. Meanwhile, the company's network remains fully or partly blocked.

A claim published by hackers is not proof, however: during the wave of claimed leaks in France on 17 October 2026, most of the figures announced were still unconfirmed. Nor do all cyberattacks aim for a ransom. The cyberattack on Beyond Gravity, the Confederation's space company, is the subject of suspected espionage that no one has officially confirmed.

How do attackers get into the company?

The most common entry points are well known. According to the press release of 16 October 2025, they are most often unpatched systems and poorly protected remote access. The targets are virtual private networks (VPN) and the remote desktop protocol (RDP) when they do not require two-factor authentication. The FOCS "Ransomware" page adds emails carrying malicious attachments.

Known but unpatched vulnerabilities weigh heavily. The FOCS semi-annual report 2025/2 notes that a vulnerability discovered in 2024 in devices from the manufacturer SonicWall helped Akira. Not all affected users had followed the manufacturer's instructions to protect themselves.

Risk also comes through suppliers, the same report notes, pointing to attacks on the software supply chain. A dated example, with no established link to ransomware: at the end of September 2026, data from the Zurich pension fund was stolen from a software supplier. And a company does not need to be singled out to be hit: the Doorway campaign against routers, uncovered in October 2026 by the company CloudSEK, automatically searched for vulnerable devices.

How many Swiss companies are affected?

The official figures only cover reported cases. In the second half of 2025, 57 ransomware-related incidents were reported directly to the FOCS, either voluntarily or under the reporting obligation, according to the semi-annual report 2025/2. Akira, already number one in Switzerland in the first half of the year, further strengthened its position.

The Confederation's SME portal, kmu.admin.ch, cites 79 incidents for the same period, compared with 47 a year earlier. It attributes 26 known attacks to Akira in the second half of 2025, compared with 7 in the first. The two publications do not explain the gap between their counts.

A single group shows the scale of the phenomenon. According to the press release of 16 October 2025, around 200 companies in Switzerland have fallen victim to Akira, with losses of several million francs. The authorities assume there are unreported cases: out of fear for their reputation, some victims pay or decide not to file a complaint.

SMEs are affected. According to the "SME Cybersecurity 2026" study, conducted by Mobiliar with digitalswitzerland and supported by the FOCS, 7% of Swiss SMEs have already been victims of extortion, or around 45,000 companies. A few of them paid a ransom. Extortion mainly affects the largest SMEs, as well as industry and construction.

Key figures

  • 57 ransomware-related incidents reported directly to the FOCS in the second half of 2025.
  • Around 200 Swiss companies victims of the Akira group, according to the press release of 16 October 2025.
  • 4 to 5 Akira-related cases per week, a record in Switzerland according to the authorities.
  • 7% of Swiss SMEs already victims of extortion, or around 45,000 companies.
  • 9% of the cyberattacks reported by critical infrastructure in the second half of 2025 were ransomware.
  • 24 hours to report a cyberattack to the FOCS, for critical infrastructure operators.

What to do in the first hours?

The first priority is to cut the attack off from the rest of the network. The FOCS page "Ransomware – what to do?" calls for immediately disconnecting the infected systems: unplug the network cable and disable wireless adapters. The press release of 16 October 2025 adds that all Internet connections should be blocked, including email, remote access and VPNs between sites.

The next steps aim to limit losses and understand the intrusion:

  • check and secure the backups without delay;
  • identify the affected systems using log files and the metadata of the encrypted files, then preserve these logs;
  • block the attackers' URLs and IP addresses, found in the logs, on the firewall or proxy server;
  • decide early on a forensic analysis, and copy memory and hard drives before any restart;
  • reinstall the systems from a trusted medium, and only then restore the data.

The primary goal, according to the FOCS, is to find the infection vector to prevent a new infection. Without in-house expertise, it advises calling in a specialised company. The office only provides support: managing an incident is the responsibility of the affected organisation, Roman Hüssy, co-head of its Govcert, explained to PME magazine. It can be reached via a form or its 24-hour on-call line.

Should you pay the ransom?

The FOCS advises against paying. There is no guarantee that the criminals will not publish the data or profit from it in some other way after payment, its "what to do" page points out. Each successful extortion also encourages the perpetrators and funds the development of attacks. A company that is nevertheless considering paying should first discuss it with the cantonal police, the office recommends.

Who to notify, and how quickly?

Several reports may be required in parallel. The table sets out those listed by the FOCS.

RecipientWho is concernedDeadline
Cantonal police where the company is basedAny victim company: a criminal complaint is recommended in all casesFrom the outset, especially if a forensic analysis is planned
Federal Office for CybersecurityCritical infrastructure operators, obligation in force since 1 April 202524 hours after detection, 14 days to complete
Federal Office for CybersecurityOther companies, voluntary reportingNo set deadline
Federal Data Protection and Information CommissionerData security breach likely to result in a high risk for the persons concerned (art. 24 of the Data Protection Act)As soon as possible

The reporting obligation was adopted by the Federal Council on 7 March 2025. Since it came into force, the FOCS has received 325 mandatory reports, 145 of them in the second half of 2025, according to the Confederation's press release of 30 March 2026. As for complaints, the OAG, fedpol and the FOCS point out that they open up more lines of investigation.

Can data be recovered without paying?

Sometimes, yes. According to the FOCS, a full or partial restoration remains possible even without a backup in several cases:

  • the ransomware has not deleted Windows shadow copies;
  • there are virtual machine snapshots or earlier versions of the files in a cloud service;
  • deleted files can be restored through a forensic analysis;
  • the encryption contains errors, or the decryption key is already known.

The NoMoreRansom.org website, a project of the Dutch police and Europol in which the Confederation takes part, offers keys that are already known. The FOCS also advises keeping the encrypted data, in case a decryption solution appears later.

How can an SME reduce the risk?

Most of these attacks can be prevented, according to the OAG, fedpol and the FOCS. Their press release cites two measures: installing updates and protecting remote access with two-factor authentication. On its "Basic protection" page, the FOCS completes the technical list:

  • take stock of the IT environment;
  • back up data;
  • install security updates;
  • use antivirus software and firewalls;
  • secure remote access;
  • segment networks.

For the office, cybersecurity is a task for management, not just the IT department. It adds staff awareness, continuity management and clear responsibilities towards service providers.

Backups remain the most concrete weak point. According to the "SME Cybersecurity 2026" study, nine out of ten SMEs back up their data, but only a quarter regularly test restoring it. Our analysis: against ransomware that also seeks to reach the copies, a backup that has never been restored remains an unverified promise. Other Swiss cases can be found in our IT threats and attacks section.

What we don't know yet

  • The actual number of attacks: outside critical infrastructure, reporting remains voluntary, and the authorities assume there are unreported cases.
  • The amount of ransoms paid in Switzerland: neither the FOCS press release of 30 March 2026 nor the SME study puts a figure on it.

Sources