Over 35,000 Swiss SMEs hit by serious cyberattacks – and only one in four tests its backups

The figure from «SME Cybersecurity 2026» that sticks most is an extrapolation: 6 per cent of the companies surveyed say they have experienced a cyberattack with serious consequences in the past three years. Applied to all of Switzerland's roughly 614,400 companies with 1 to 49 employees, that is over 35,000 businesses, according to the study. How much size matters is shown by the second figure: among companies with at least ten employees, the share of those affected rises to as much as 16 per cent.

Even more common than a serious attack is an attempt at blackmail. Around 7 per cent of the SMEs surveyed say they were extorted, the study reports – extrapolated, around 45,000 companies. Larger businesses, as well as industry and construction, are more affected, and according to the study some of those blackmailed paid up. No single type of attack dominates: phishing, password hacking, malware and attacks on networks and servers each play a part in roughly a third of the incidents, the study says. In the study deck with all results, phishing leads with 39 per cent, followed by password hacking (32 per cent), malware (30 per cent) and network or server attacks (29 per cent). These values, however, rest on only 44 affected companies and are correspondingly uncertain.

What is interesting is what those affected name as the biggest consequence. According to the study, it is not the financial damage that comes first but the effort of fixing the damage, followed by the emotional strain. Only then come financial losses, damage to reputation and the loss of customer data. For a business with five people, that means an attack costs time and nerves before it costs money.

The study's authors state that cybercrime has become a business risk for Swiss SMEs. According to the study, 23 per cent of respondents count it among their company's biggest strategic risks – practically level with inflation and rising costs. And almost nine in ten SMEs (88 per cent) regard cybercrime as a problem to be taken seriously.

Technically, Swiss small businesses are in fairly good shape, according to the study. Nine in ten SMEs run regular backups; the share of companies without a regular backup has fallen to just 4 per cent. More than 80 per cent install software updates, according to the NCSC, and two-factor or multi-factor authentication (MFA) is among the widely adopted measures, the study says. In the study deck, 55 per cent of respondents say they have fully implemented MFA, 19 per cent not at all. Around three quarters of the companies with backups store them in Switzerland, according to the study.

The catch lies in the detail of those backups: only a quarter of SMEs regularly test whether the saved data can actually be restored, the study finds. In the study deck, 27 per cent say yes and 63 per cent say no. A backup whose restore has never been checked is, when it matters, a hope rather than an insurance policy. That is exactly what Anu Anthamatten, project manager at digitalswitzerland, criticises: «It is not enough simply to back up data.»

The gap in organisational measures is even clearer. According to the study, only about a third of SMEs train their staff regularly or systematically inventory their own IT systems. Emergency plans for business continuity are rarer still, the study says, and security audits are the least common measure of all. On its study page, la Mobilière puts the figures at 31 per cent (training), 28 per cent (emergency plan) and 15 per cent (audits); the same figures appear in the study deck. On training, according to la Mobilière, hardly anything has changed compared with previous years.

The picture that emerges: the firewall is in place and the data is backed up, but hardly anyone has rehearsed what happens the day after an attack. Who restores the data, who informs the customers, who calls the IT provider? According to the study, only a minority of businesses answer these questions in advance.

The importance attached to cybersecurity has shifted considerably within a year. According to the study, 46 per cent of the companies surveyed rate cybersecurity as important or very important; in 2025 it was 33 per cent. Correspondingly, the share of SMEs for which cyber risks are not a priority fell from 42 per cent to 36 per cent. Responsibility is clearer too: the share of businesses in which cybersecurity is defined internally as part of one person's job rose from 15 per cent to 21 per cent, the study says. A further 9 per cent have a dedicated specialist role, and 27 per cent hand the task to an external partner. On its study page, la Mobilière sums up internal responsibility at 31 per cent, up from 22 per cent the year before.

In the NCSC's announcement, the study's authors read this as a good sign: cybersecurity is increasingly understood as a leadership task and no longer merely an IT matter. According to the study, around two in five companies consider it likely or very likely that they will implement additional security measures in the next one to three years; in answer to a different question in the study, 29 per cent say they are concretely planning to do so.

At the same time, many businesses underestimate the risk to their own shop. According to the study, a majority consider the danger of being out of action for at least a day because of a cyberattack to be rather small; la Mobilière puts this share at 52 per cent. Only about one in ten SMEs rates this risk as high. That sits uneasily with the 6 per cent actually seriously affected – and even more uneasily with the 16 per cent among companies with ten or more employees.

On AI, respondents are unambiguous: 81 per cent assume, according to the study, that the cyber threat will continue to grow because of artificial intelligence. Almost half of SMEs do not yet use AI in their own projects, according to the NCSC. And there is room for improvement in cooperation with the federal authorities: 40 per cent of companies would be willing to report relevant cyber incidents to the NCSC voluntarily, the study says. The NCSC's Cyber Security Hub, a platform for sharing information, is used so far by only around 7 per cent of companies or their IT providers.

The NCSC presented the study on 22 October 2026 in an announcement of its own, placing the organisational side in the foreground. Romain Geiser, programme manager for the national cyber strategy at the NCSC, names «information, prevention and cooperation» as «key building blocks of a resilient cyberlandscape». The centre points to its information services and to the option of reporting incidents – the more reports come in, the better it can warn of ongoing waves of attacks.

For Jesús Pampín, head of the Cyber Risk Competence Centre at la Mobilière, «cybercrime has become a real business risk for Swiss SMEs». His conclusion: «Cybersecurity must therefore not be the sole responsibility of the IT department.» It belongs at board level, he says, and must be part of the corporate strategy. Remarkable for an insurer is the addition he also makes: «Cyberinsurance can mitigate risks, but it is no substitute for personal responsibility.»

Anu Anthamatten, project manager at digitalswitzerland, sees many companies relying too heavily on basic security measures while neglecting organisational contingency planning. Her advice: «SMEs must regularly test whether they can quickly resume operations in the event of a cyberattack.» Marc K. Peter, the study's project leader and a lecturer at HES-SO Valais-Wallis, links cybersecurity to digitalisation as a whole: according to the study, SMEs with a high level of digital maturity also rate their own resilience higher. «Cybersecurity therefore does not begin with the firewall, but with a clear digital strategy,» he says.

The study itself closes with a checklist that recommends, among other things, knowing in advance where support is available in an emergency – from the IT provider, the insurer or the NCSC. To put the reporting figures in context: in the first half of 2026, according to the NCSC's semi-annual report, the centre received 27,128 voluntary reports, plus 200 mandatory reports of cyber incidents from operators of critical infrastructure; ransomware reports remained stable at 79.

The study «SME Cybersecurity 2026» was published by the Swiss insurer la Mobilière in cooperation with the National Cyber Security Centre (NCSC), digitalswitzerland, HES-SO (the University of Applied Sciences and Arts Western Switzerland), HWZ (Zurich University of Applied Sciences in Business Administration) and SATW (the Swiss Academy of Engineering Sciences). The survey was carried out by YouGov: 507 online interviews with managers of SMEs with 1 to 49 employees, between 24 June and 10 July 2026, drawn from an internet panel of around 115,000 members. The quotes in this article are taken from the NCSC's English announcement.

The population is the roughly 614,400 Swiss companies of this size according to STATENT 2025, the business register of the Federal Statistical Office. The sample was set by quota for company size and language region and then weighted proportionally. The confidence interval, according to the study, is plus or minus 4.4 percentage points at a 95 per cent confidence level. For the overall figures that is solid; for subgroups it gets thin. In the study deck, the figures on attack types and consequences rest on just 44 affected companies and are therefore indications rather than hard numbers.

Two things belong to the context. First, the publisher is an insurer that sells cyber insurance. That does not make the figures wrong – the method and the partners are disclosed, and the NCSC co-sponsors the study – but the emphasis on business risk suits the publisher's business model. Second, all values are based on self-reporting by management. Whether a business really tests its backups regularly, or whether the boss merely believes it does, is something an online survey cannot verify.

The study is available as a whitepaper in four languages on cyberstudie.ch, along with a deck with all results (the deck is in German only). If you want to look up the figures in this article, the page references in the English edition are: attacks and blackmail on pages 10 and 11, priority and responsibility on pages 14 to 16, technical and organisational measures on pages 18 to 20, methodology on page 26.

The study surveys companies with up to 49 employees, but the gaps it finds are familiar to the self-employed, sole traders and private individuals as well. The most important gap is the backup illusion: backing up data has become routine, practising a restore has not. If you have never restored your backups, you do not know whether they are complete, whether you still know the password to the backup and how long a restore takes. One trial run per quarter with a few important files is enough to find out.

Part of that is the question of where the copies live. Cloud storage with version history is a sensible addition, because it keeps older versions of a file and so also helps against encrypted or accidentally overwritten files – provided the retention period is long enough. Which services do that, for how long and at what price is in our comparison (→ pCloud vs Google Drive vs Dropbox 2026: which cloud storage is worth it?). Cloud storage does not, however, replace a second backup kept separate from your everyday device.

The second point is access. Password hacking and phishing are among the most common types of attack, according to the study, and the same combination helps against both: a password manager that creates a separate password for every service and only fills it in on the genuine website, plus two-factor authentication for email, cloud storage, e-banking and shop accounts. Our recommendations, including the weaknesses of the individual programs, are in (→ Best password managers 2026: 1Password, NordPass, Bitwarden and Proton Pass compared). How targeted phishing has become is shown by the NCSC's current warning about fake hotel cashbacks (→ Hotel phishing with a 7.5 per cent «cashback» targets TWINT accounts – Switzerland's NCSC warns): the attackers knew their victims' names, booking dates and hotels.

What the study does not provide is a reason for panic or a sales argument. Arithmetically, 94 per cent of the businesses surveyed had no serious attack in three years. Whether cyber insurance is worthwhile for a small company depends on the industry, the amount of data and how dependent the business is on its IT – that is something we cannot judge here and do not rate. The measures in the list below, by contrast, cost almost nothing except a few hours, and they cover exactly the weaknesses the study finds in the majority of SMEs.