Swiss SMEs are in the line of fire too
Many small companies still think cyberattacks mostly hit larger ones. The official figures say otherwise.
Published 16.10.2026
4%
of Swiss SMEs suffered a serious cyberattack in three years, about 24,000 businesses (FHNW, 2024)
73%
of the SMEs affected reported substantial financial losses
79
ransomware cases reported to the NCSC in the first half of 2026
A risk many underestimate
In the 2024 FHNW study, half of the surveyed companies considered the risk of a severe attack low, and nearly 40% had no emergency response plan or business continuity strategy. Among those actually hit, almost three in four reported substantial financial losses.
What the NCSC sees
In the first half of 2026 the National Cyber Security Centre received 27,128 voluntary reports and 200 notifications of incidents subject to mandatory reporting. The number of Swiss ransomware cases stayed stable at 79. In the second half of 2025 there were also 79 cases, against 47 a year earlier, and 73 cases of business email compromise against 49: criminals get into the mail system, read ongoing exchanges and change the bank details on invoices. One of these cases cost 1.5 million francs.
What this means for a small company
Reporting was largely voluntary, so these figures show what was reported, not everything that happened, and they do not say that a given company will be hit. They do show that preparing is not a luxury: knowing what you have, who has access to what, and what happens on the day of an incident. The NCSC itself recommends multi-factor authentication and up-to-date systems.
Starting from a clear picture of your situation beats discovering it after an incident. That is the purpose of a Kadenz check.
Sources
- KMU-Portal (SECO) · FHNW Cyberstudie 2024 · 27.11.2024
- BACS / NCSC · Semi-Annual Report 2026/1 · 24.08.2026
- KMU-Portal (SECO) · BACS Halbjahresbericht 2025/2 · 06.05.2026
We summarise; we do not reproduce. Sources consulted on 16.10.2026. These texts inform: they are not legal advice, and an average figure does not predict what will happen to a given company.