Since 1 April 2025, operators of critical infrastructure in Switzerland have had to report cyberattacks to the Federal Office for Cybersecurity. The basis is the Cybersecurity Ordinance under the revised Information Security Act. With the semi-annual report 2026/1, figures covering eighteen months are now available.

In the first half of 2026, the Federal Office received 200 mandatory cyber incident reports, along with 27,128 voluntary reports. In the first six months after the duty was introduced, there had been 164 mandatory reports, most often from the financial sector, followed by IT and energy. The Federal Office speaks of a volume of reports that has stabilised at a high level.

What these figures say, and what they do not

They say little about the threat situation and much about the organisation. That more is being reported does not mean that more is happening. It means that more companies recognise an incident as reportable at all, and that the internal processes are in place for it.

The reverse also holds: anyone who has never reported should check whether that is due to calm conditions or to the fact that no one is asking the question.

Since October 2025, a breach is sanctioned

A report must be made within 24 hours of discovery. Since 1 October 2025, the sanctions have been in force: anyone who breaches the duty risks a fine of up to 100,000 francs.

The path to that point has several stages. On indications of a breach, the Federal Office first contacts the operator. Only if the operator responds neither to the contact nor to the subsequent ruling can a criminal complaint be filed. The fine is therefore not automatic but the end of an escalation that could have been halted at several points.

The 24 hours are the real problem

Twenty-four hours are technically feasible and organisationally demanding. In that time, someone has to detect the incident, assess whether it falls under the reporting duty, gather the necessary information and submit the report. This does not work if it is only sorted out during a live incident who decides and who reports.

The breaking points rarely lie in the technology:

  • The incident is discovered on a Friday evening and no one with decision-making authority is reachable.
  • The IT service provider notices the attack first but is not contractually obliged to inform the company without delay.
  • It is unclear whether the specific incident falls under the reporting duty, and clarifying that takes longer than the deadline.

Why this concerns the leadership itself

For the current reporting period, the Federal Office describes cases in which attackers deliberately impersonated IT help desks or senior figures in order to compromise systems or trigger payments. Artificial intelligence is systematically used to make the approach appear personal and credible.

This means that the executive team is not only responsible for the report but is itself an attack surface. Both lead to the same conclusion: the reporting duty is not an IT task. It is a question of responsibility and reachability, and it hinges on the contracts with service providers.

Three points should be set down in writing before the first incident occurs: who decides within 24 hours whether a report is made; how that person is reached outside office hours; and what reporting deadline has been contractually agreed with service providers. If one of these is missing, the deadline cannot be met when it matters.

The reporting duty thus fits into a development we have already observed with NIS-2: the legislator is deliberately shifting responsibility for cyber risks upwards. Why this cannot be delegated to IT is something we described in Cyber Security as a Board Matter. In our Cyber Security Advisory, we examine with companies whether their processes can withstand the 24-hour deadline.