What the BACS report reveals
The Federal Office for Cybersecurity (BACS) published its half year report for H1 2026 on August 24th. The numbers are sobering: 27128 voluntary reports came in, plus 200 mandatory incident reports from critical infrastructure operators. For comparison: in the second half of 2025, there were just 135 mandatory reports. So nearly double within six months.
Whether that is because of more attacks or because the reporting obligation (in effect since April 2025) is finally gaining traction.. probably both.
Ransomware: more groups, less dominance
The BACS recorded 79 ransomware cases in the first half of 2026. Same number as the previous period. Sounds like stagnation, but it is not: the number of active ransomware families grew from 21 to 29. The ecosystem is fragmenting.
The previously dominant group Akira lost significant market share; from about 35 percent down to 19 percent. Instead, attacks are spreading across more and more smaller groups. New to Switzerland is e.g “The Gentlemen”, a gang that first appeared in early 2026. In May 2026, their own data got leaked (karma does exist after all), yet they kept going. Latest Swiss victim: property manager Gfeller Treuhand from Dübendorf in August 2026.
And theres a new trend: some groups have dropped encryption entirely. They only steal data and threaten to publish it. Faster, simpler, less risk of getting caught…
How do they get in?
The main entry point remains: vulnerabilities in VPN gateways and firewalls. Internationally, this accounts for about a third of all cases. And these are exactly the systems that are supposed to ensure security (the irony is not lost on anyone).
The most common attack types according to the report:
- Hacking and unauthorized access: 26 percent
- Credential theft: about 14 percent
- DDoS attacks: roughly 13 percent
- Data exfiltration: also around 13 percent
Most affected were public administration (19 percent) and the IT and telecommunications sector (nearly 19 percent). Administration as the top target is not exactly surprising; public institutions are often chronically underfunded when it comes to IT security.
AI makes phishing better
What the report also confirms: attackers now use artificial intelligence systematically. Not to hack systems, but to deceive people. Personalized phishing emails tailored to the recipient, fake voices on the phone, convincing fake job offers on LinkedIn (the BACS calls this the “Dream Job Playbook”).
The problem: these messages are often nearly indistinguishable from real ones. The days of “Click hier on this link” with three spelling mistakes are definitely over.
One piece of good news
Not everything is bleak. Since July 1, 2026, mobile phone numbers must be labeled. The effect was immediate: the number of fraudulent authority calls using spoofed Swiss numbers dropped by over 75 percent. From around 400 cases per month to under 100.
Shows that regulation can work when it targets the right spot.
What to do
The BACS recommendations are not surprising, but still valid:
Patch VPN and firewall systems consistently. Test backups regularly (not just create them). Document reporting channels and crisis plans before an incident occurs.
If you want to have your own security posture assessed: that is exactly what we offer. From vulnerability assessments to social engineering tests to full red team assessments.
The full BACS report is available here for download.
And whether the numbers will look any better in the second half of the year…