Cyber attacks worldwide reach new high in April

Once again, Check Point Research (CPR), the security research division of Check Point Software Technologies, has published its Monthly Cyber Threat Report. The data from April 2026 shows After a brief lull in March, threat actors have refocused their campaigns - and continued with increased intensity.

Global rise - DACH region under pressure

In April 2026, companies worldwide recorded an average of 2201 cyber attacks per week. This represents an increase of ten percent compared to the previous month and eight percent compared to the same period last year. The April data thus confirms that the temporary slowdown in March was not a change in trend.

In the DACH region, the upward trend is clearly returning. Switzerland remained comparatively stable with a minimal increase of one percent to 1246 weekly attacks. In Germany, attacks rose by four percent to 1377 per week, in Austria even more significantly by 17 percent to 2122. Austria therefore recorded the highest attack frequency in the German-speaking region and is also significantly above the European average of 1848 attacks.

Marco Pierro, Country Manager Switzerland at Check Point, puts the Swiss figures into perspective: «With a minimal increase of one percent to 1246 weekly attacks, Switzerland is more stable than its neighboring countries, but this should not lead to complacency. More than 1,200 attacks per week mean continued pressure, particularly on the public sector and healthcare. The relative stability is no reason to sound the all-clear, but an opportunity to proactively strengthen security measures as long as there is room for maneuver.»

In Switzerland, the sectors most affected by cyber attacks in April were energy and utilities, education, healthcare and medicine.

Education and government in the global spotlight

In April 2026, the education sector was once again the most under attack globally, with an average of 4946 attacks per organization per week - an increase of eight percent compared to the previous year. The government sector followed with 2797 attacks per week, followed by the telecommunications industry with 2728 attacks (up three percent). The hospitality, tourism and leisure sector was once again conspicuous: in the run-up to the peak travel season, increased transaction volumes, third-party dependencies and a faster operational cycle increase the attack surface - conditions that cyber criminals specifically exploit.

Regionally, all regions recorded an increase in April compared to the previous month for the first time. Latin America led the global statistics with 3364 attacks and a year-on-year increase of 20%. The APAC region followed with 3213 attacks (up four percent), while Africa remained among the most affected regions with 2940 attacks despite a nine percent decrease. Europe recorded 1848 attacks (up nine percent), North America 1499.

GenAI-related risks remain at a high level

Despite fluctuations in the general volume of attacks, risks associated with generative AI remained consistently high in April. The increasing integration of GenAI into the workplace continues to outpace the adaptability of governance and security controls. One in 28 GenAI prompts carried a high risk of sensitive data exposure, and 90 percent of organizations that regularly use GenAI tools were affected by this risk. A further 19 percent of prompts contained potentially sensitive information. Companies used an average of ten different GenAI tools, indicating fragmented adoption. The average corporate user generated 77 GenAI prompts per month. The persistently high number of high-risk submissions shows that organizations remain vulnerable to password leaks, intellectual property disclosure and unintentional amplification of third-party risks.

Ransomware: Twelve percent more than in the previous year

Ransomware remained one of the most dangerous threats in April 2026. With 707 publicly reported attacks, the number increased by five percent compared to the previous month and by twelve percent compared to April 2025. North America was the most affected region with 46 percent of reported incidents, followed by Europe with 27 percent and Asia-Pacific with 17 percent. Europe's share increased slightly compared to March (24%) - an indication of the attackers' continued focus on high-value and highly regulated markets.

The United States remained the most affected country with around 42% of reported ransomware victims. Germany was in second place with five percent, followed by Canada and Italy (five and four percent respectively) and the United Kingdom (four percent). In terms of sectors, business services were the most affected with around 34%, followed by consumer goods and services (14%) and industrial manufacturing (10%).

The ransomware landscape remained fragmented in April, but continued to be dominated by a small group of highly prolific actors. In total, 56 different ransomware groups attacked organizations worldwide - a new high. Qilin led with 15 percent of published attacks. The Gentlemen were responsible for ten percent of attacks, DragonForce nine percent.

Patrick Fetter, Lead Sales Engineer and Cyber Security Evangelist at Check Point, summarizes the findings: «The figures for April show that the slowdown in March was only temporary. Cybercriminals are highly professionalized and adaptable. They are shifting the targets and timing of attacks, becoming more flexible and relentless. In addition, the number of ransomware attacks continues to rise - and all this is happening while companies are in a transformative phase characterized by the integration of GenAI into daily workflows. Security leaders must assume that cyber risks are continuous and focus on prevention, governance and AI-powered security that can stop threats before they cause damage.»

Source: www.checkpoint.com

This article originally appeared on m-q.ch - https://www.m-q.ch/de/cyber-angriffe-weltweit-im-april-auf-neuem-hoechststand/