Cyberattacks on Swiss businesses nearly double in a year

Cyberattacks on organisations in Switzerland have nearly doubled within a year. This is shown by the monthly analysis from security firm Check Point, published on 19 October and covering the month of September.

In September 2026, Swiss businesses and public bodies faced an average of 1,928 attacks per week, compared with 971 in the same month of 2025. The previous month, August, the figure stood at 1,515 weekly attacks: the increase is therefore continuing month after month.

The most targeted sector remains public administration. Compared with August, healthcare has moved up to second place, while consumer goods and services have dropped to third.

Despite the rise, Switzerland still remains below the European average of 2,545 weekly attacks per organisation. At the European level, year-on-year growth reached 61%, the highest among the regions tracked by Check Point. Worldwide, the average is 2,803 attacks per week per organisation, 48% more than a year earlier. Latin America is the most targeted region in the world, with 3,813 weekly attacks.

Education is the most targeted sector worldwide

Globally, the sector with the most attacks is education, with 6,656 weekly attacks per organisation, 59% more year-on-year. Check Point links the rise to the start of the new school and academic year. Telecommunications follows with 3,483 attacks, then public administration with 3,443.

Regarding ransomware, Check Point bases its estimates on sites where extortion groups publish their victims, while noting that not all cases are captured this way. In September, 824 ransomware attacks were recorded worldwide, 53% more than a year earlier but down from 1,042 in August. The most affected sectors are business services, with 31.3% of cases, consumer goods and services with 15.2%, and industrial manufacturing with 11%.

The most active ransomware group of the month was "The Gentlemen", active since mid-2025, which with 13% of cases overtook Qilin, at 9%. Akira follows in third place, with 5%.

Check Point also notes that the attack data comes from its own Threatcloud platform, which analyses millions of indicators of compromise daily, drawn from more than 150,000 networks and millions of connected devices.