Cyberattacks on Swiss Companies Nearly Double: Check Point Reports a 99 Percent Increase in September
Check Point Research’s Monthly Cyber Threat Report shows that Swiss companies recorded an average of 1,928 cyberattacks per week in September 2026—nearly twice as many as in the previous year. Globally, too—particularly in the education sector—the threat landscape is increasing significantly.
The number of cyberattacks on Swiss companies nearly doubled in September 2026 compared to the same month last year. This is according to the latest Monthly Cyber Threat Report from Check Point Research (CPR), the security research division of Check Point Software Technologies. Swiss organizations recorded an average of 1,928 attacks per week, a 99 percent increase compared to the same period last year. While Switzerland still remains below the European average of 2,545 attacks, the rate of increase is remarkable.
The number of attacks also rose significantly in the rest of the DACH region. Germany recorded the sharpest increase in the region, with 2,316 attacks per week (+103 percent), while Austria recorded 3,077 attacks (+96 percent).
Significant Increase in Attacks Worldwide
Globally, companies recorded an average of 2,803 cyberattacks per week in September. This represents a 16 percent increase from the previous month and a 48 percent increase from the previous year. Since May 2026, the number of weekly attacks per organization has risen from 2,055 to 2,803—a 36 percent increase over five months. For security researchers at Check Point, this is not a short-term spike but rather an ongoing trend.
In Switzerland, September also saw a shift in the sectors most heavily affected: While public administration held its position, the healthcare sector moved up in the rankings, whereas the consumer goods and services sector lost ground.
Education is the hardest-hit sector worldwide
Globally, the education sector remained the hardest-hit industry, with an average of 6,656 attacks per organization per week—an increase of 59 percent compared to the previous year and 24 percent compared to August. This sharp increase may be attributed to the start of the new school and academic year, as this is when large numbers of students, teachers, parents, and other users begin connecting to educational institutions’ networks again.
The telecommunications industry came in second with 3,483 attacks per week (+29 percent), just ahead of the government sector with 3,443 attacks (+37 percent). Both sectors share a broad user base, the provision of essential services, and complex digital environments that offer attackers numerous entry points.
Geographically, Europe saw the sharpest increase: With an average of 2,545 attacks per week, the numbers rose by 61 percent compared to the previous year. In terms of absolute attack volume, Latin America remained the hardest-hit region with 3,813 attacks per week (+35 percent), followed by Africa with 3,701 attacks (+28 percent) and the APAC region with 3,593 attacks (+35 percent). North America also saw a significant increase, rising 50 percent to 2,197 attacks.
Generative AI Increases the Risk to Sensitive Data
Generative AI is firmly embedded in everyday business operations—and as its use grows, so does the risk that sensitive information will end up in AI tools. After the rate of risky prompts fell in August to its lowest level in months, it rose again in September. One in every 39 GenAI prompts in September posed a high risk of disclosing sensitive data; in August, the ratio was one in every 43. The global exposure rate thus stood at 2.5 percent. This affected 89 percent of companies that regularly use GenAI tools. An additional 14 percent of prompts contained potentially sensitive information.
Enterprise users generated an average of 131 prompts per month, up from 106 in August. On average, companies used eight different GenAI tools. Network and IT infrastructure data—such as hardware and network configurations or IP addresses—appeared most frequently, in 71 percent of companies. This was followed by financial data (70 percent), legal and regulatory information (68 percent), personnel and HR data (62 percent), and personal data (60 percent).
Cybercriminals also ramped up the pressure via email in September: One in every 91 emails (1.1 percent) was classified as phishing, compared to one in every 112 emails (0.89 percent) in August. Of the phishing emails, 81 percent contained links and 11 percent contained attachments. Malicious links thus remain the primary method of attack; the remaining campaigns relied on social engineering without any links or attachments.
Ransomware remains well above last year's level
In September 2026, 824 ransomware attacks were publicly reported, a 53 percent increase from September 2025. Although the number declined month-over-month from 1,042 attacks in August, it remained well above the previous year’s figure. Business services were once again the hardest-hit sector, accounting for 31.3 percent of all victims, followed by consumer goods and services (15.2 percent) and industrial manufacturing (11.0 percent). Since service providers often manage data or system access on behalf of multiple clients, a single incident can have consequences that extend far beyond the affected company.
North America remained the hardest-hit region, accounting for 46 percent of reported incidents, followed by Europe (25 percent) and the APAC region (17 percent). At the country level, the U.S. accounted for 41.9 percent of victims, well ahead of Germany (4.0 percent) and Canada (3.6 percent). These findings come from so-called “ransomware shame sites,” which are used by extortion groups to publicly list their victims. While this data is inherently selective, it offers valuable insight into the scale, prevalence, and evolving tactics of the ransomware ecosystem.
There was a change at the top of the most active ransomware groups in September: The Gentlemen replaced Qilin as the most active group and was responsible for 13 percent of the reported attacks. This rapidly growing Ransomware-as-a-Service (RaaS) group, which has been active since mid-2025, sells initial access to corporate networks and targets Windows, Linux, and ESXi environments. Qilin followed with 9 percent; this RaaS group, established in 2022, publishes its victims’ data and provides partners with infrastructure for encryption, negotiations, and support. Akira accounted for 5 percent and has been using malware targeting Windows, Linux, and ESXi systems since 2023. In addition to these three leading actors, 80 other extortion groups reported attacks in September.
The findings in the report come from Check Point’s AI platform, ThreatCloud, which analyzes millions of indicators of compromise every day. ThreatCloud is powered by more than 50 AI-driven engines and fed with information from more than 150,000 networks and millions of endpoints.
For more information on the Monthly Cyber Threat Report, see the Check Point Blog.
