Switzerland's Federal Office for Cybersecurity (BACS) published its Halbjahresbericht 2026/1 on August 24, 2026, and the headline number looks reassuring: 79 ransomware cases in the first half of the year, identical to the second half of 2025. Read past the topline, though, and the picture is less settled. The number of active ransomware families operating against Swiss targets jumped from 21 to 29 in six months, and Akira — long the single dominant group — saw its share of documented attacks fall from roughly 35% to 19%. A flat case count is masking a threat landscape that fragmented sharply.
Why Fragmentation Matters More Than the Case Count
A stable headline number invites the wrong headline: "ransomware plateaued." What BACS's data actually shows is that the market deconcentrated. When one gang holds a third of all attacks, defenders can build a defensible model around that gang's tooling, ransom notes, and negotiation patterns. When the same volume of attacks is spread across 29 groups, no single threat profile covers the field. BACS itself frames this as a shift toward diversification and fragmentation of ransomware families — and notes some groups are skipping encryption entirely, extorting victims purely over stolen data, which is faster to execute and harder to detect than a full encryption run.
The practical lesson for Swiss operators, which the report and independent analysis both converge on, is that hardening should target generic entry points — unpatched VPN gateways, exposed firewalls, stolen credentials — rather than any one gang's signature. Attack-vector data in the same report shows hacking and unauthorized access accounting for roughly 26% of incidents, with credential theft, DDoS, and data exfiltration each in the low teens. None of that is gang-specific; all of it is a patching and access-control problem.
The Reporting Mandate Is the Real Story
The more consequential number in this report isn't the ransomware count — it's the 200 mandatory incident reports BACS received from critical infrastructure operators in H1 2026, continuing a steady climb from 135 in the second half of 2025. Switzerland's Information Security Act (Informationssicherheitsgesetz, ISG) imposed a 24-hour reporting duty on critical infrastructure operators — energy, water, health care, finance, telecoms — for cyberattacks with serious consequences, effective April 1, 2025. Non-compliant organizations face a fine of up to CHF 100,000 after two missed deadlines.
Here the case for the mandate deserves to be made honestly, not waved away. Before April 2025, BACS's picture of attacks on critical infrastructure was built on voluntary submissions — necessarily partial, skewed toward operators already inclined to disclose. A mandatory, time-bound duty closes that gap. The fact that reports have risen each half-year since the law took effect is not evidence that Switzerland is under growing attack so much as evidence that BACS can finally see attacks it was previously blind to. That is exactly what a reporting law is supposed to do, and it is why the fragmentation finding in this same report is credible in the first place — you cannot track 29 active families without a reporting pipeline wide enough to catch incidents that no single gang's brand recognition would otherwise surface.
Where Proportionality Still Applies
The honest caveat is that a rising mandatory-report count is also a rising compliance burden, and BACS's own commentary elsewhere in its H1 2026 cycle offers a useful contrast in regulatory design. The same report highlights that an expanded call-labeling requirement for spoofed Swiss numbers cut fraudulent-call reports by more than 75% in July 2026 — a narrowly targeted, low-friction rule that produced an outsized result without a 24-hour clock or a six-figure fine attached. That's the model worth generalizing: measures scoped tightly to the mechanism of harm, rather than blanket duties layered onto every critical-infrastructure operator regardless of size or exposure.
The ISG's reporting duty, by contrast, applies uniformly across sectors as different as drinking-water utilities and insurance companies, with the same 24-hour window and the same penalty structure. For a well-resourced bank's security team, that's a manageable process addition. For a small municipal utility, it's a harder lift, and BACS has already acknowledged the mandate is generating real workload on its own side too. None of that argues for weakening the duty — the data value is proven — but it does argue for BACS to keep tuning thresholds and support (templated reporting, sector-specific guidance) so the law doesn't become a paperwork tax on the least-resourced operators it was designed to protect.
The better takeaway from this report isn't that Switzerland faces a worsening ransomware crisis. It's that a young disclosure law is doing exactly what disclosure laws are for: turning an opaque threat into a measurable one, one honest report at a time.