In short. A company hit by a cyberattack in Switzerland must, from the first hour, contain the attack, preserve the evidence and work out what it is required to report. A data security breach likely to result in a high risk for the people concerned must be reported to the FDPIC as soon as possible (art. 24 FADP). Critical infrastructure operators, banks and insurers included, must report qualifying cyberattacks to the federal cybersecurity office within 24 hours. Unauthorised access to a computer system is prosecuted only on complaint, filed within three months of knowing the offender. The federal authorities advise against paying a ransom.
Monday, 7.40 a.m. No file will open. Every screen shows the same message, a countdown and a bitcoin address. Someone suggests reinstalling everything from Friday’s backup. Sensible, at first sight. But until you know how the attacker got in, he can come back the same way, and the traces that would show the way in disappear with the reinstallation.
The federal cybersecurity office (OFCS in French, BACS in German, presented in English as the National Cyber Security Centre, NCSC) received 64,733 reports in 2025. Between 1 April 2025, when the reporting obligation came into force, and the end of the year, critical infrastructure operators filed 222 mandatory reports, 9.2% of them for ransomware attacks, according to its annual report published on 16 February 2026.
What kind of attack are you dealing with?
Ransomware
Data encrypted, often copied first, and a ransom demanded under threat of publication. Unauthorised access to a protected system (art. 143bis para. 1 Swiss Criminal Code, SCC), damage to data (art. 144bis no. 1 SCC) and extortion (art. 156 no. 1 SCC, up to five years) usually overlap. In a joint press release of 16 October 2025, the Office of the Attorney General, fedpol and the NCSC state that “the authorities advise not to pay the ransom, as this helps to fund the perpetrators’ activities”. They also recommend consulting the authorities before taking any step when a ransom is demanded.
Data stolen or leaked
Customer files, payroll, employee records. Unauthorised obtaining of specially protected data, for unlawful gain, carries up to five years (art. 143 para. 1 SCC). For the company, the pressing questions are notification to the FDPIC and information of the people concerned.
CEO fraud or a fake supplier
An email in the managing director’s tone, an invoice where only the IBAN has changed. Where the offender deceives an employee through cunning (astute deceit, a demanding condition under Swiss law) and the employee makes the payment, the offence is fraud (art. 146 para. 1 SCC). Where he manipulated a data processing operation, e-banking for instance, computer fraud applies (art. 147 para. 1 SCC). Speed then matters more than anything. Assets that will probably have to be returned to the victim can be frozen (art. 263 para. 1 let. c CrimPC), provided they are still in the receiving account. See our article on frozen bank accounts in Switzerland and our page on fraud and asset recovery.
The first 72 hours, step by step
- Isolate, do not wipe. Disconnect affected machines, cut compromised remote access, keep the logs. The authorities’ first objective is to identify the infection route and prevent reinfection.
- Set up a small crisis team. Management, IT or the external provider, a lawyer, and whoever knows the insurance policy. One voice to the outside world.
- Sort out the notifications. FDPIC, NCSC if the company is subject to the duty, insurer. Each has its own trigger and deadline.
- Stop the money. Call the bank the same day and file a criminal complaint without waiting for the forensic report.
- Document. A timeline to the hour, the ransom note, wallet addresses, email headers, access logs, forged invoices.
- Communicate carefully. Instructions to staff, information to clients where needed, and no negotiation with the attacker without advice.
Is data breach notification mandatory in Switzerland?
Yes, above a threshold. The controller must notify the Federal Data Protection and Information Commissioner (FDPIC) as soon as possible of a data security breach that is likely to result in a high risk to the personality or fundamental rights of the data subjects (art. 24 para. 1 FADP). The notification states at least the nature of the breach, its consequences and the measures taken or planned (para. 2). The Act sets no deadline in hours. A processor must report every breach to the controller (para. 3). Data subjects are informed where necessary for their protection or where the FDPIC so requires (para. 4). One point matters to directors. A notification may be used in criminal proceedings against the person required to notify only with that person’s consent (para. 6).
Which companies must report a cyberattack within 24 hours?
Since 1 April 2025, the organisations listed in art. 74b of the Information Security Act (ISA) must report cyberattacks on their IT resources to the federal cybersecurity office (art. 74a para. 1 ISA). The list includes banks, insurers and financial market infrastructures, energy suppliers, hospitals on the cantonal list, telecommunications providers, and cloud and data centre providers with a registered office in Switzerland. Some small organisations are exempt, for instance in the pharmaceutical field where they employ fewer than 50 people and their annual turnover or balance sheet total in the relevant field does not exceed CHF 10 million (art. 12 para. 2 Cybersecurity Ordinance). The office can confirm whether an organisation is subject to the duty and issue a ruling on request (art. 74a para. 2 ISA).
A report is required where the attack endangers the functioning of the infrastructure, has led to manipulation or leakage of information, went undetected for a long period, or involves blackmail, threats or coercion (art. 74d ISA). It is due within 24 hours of detection (art. 74e para. 1 ISA) and may be completed within 14 days (art. 16 para. 1 Cybersecurity Ordinance). The person reporting for the organisation does not have to include in the report information that would expose them to criminal prosecution (art. 74e para. 4 ISA). Since 1 October 2025, wilful failure to comply with a final ruling issued under threat of that fine, after an initial deadline has passed, can lead to a fine of up to CHF 100,000 (art. 74g and 74h para. 1 ISA).
What about the insurer?
The claimant must notify the insurer as soon as he becomes aware of the loss and of his entitlement (art. 38 para. 1 Insurance Contract Act, ICA). If the delay is his fault, the indemnity can be reduced to what it would have been with timely notice (para. 2). Many cyber policies provide an emergency line and appointed providers, worth checking before instructing others.
Filing a criminal complaint
Usually against persons unknown, with the police or the Public Prosecutor, in writing or orally (art. 304 para. 1 CrimPC). The federal authorities recommend that victims file a criminal complaint in every case.
Unauthorised access is prosecuted only on complaint (art. 143bis para. 1 SCC). So is damage to data, unless it causes considerable damage, in which case it is prosecuted ex officio (art. 144bis no. 1 SCC). Unauthorised obtaining of data, fraud, computer fraud and extortion are prosecuted ex officio, except, for the first three, between relatives or members of the same household. The right to file a complaint expires three months after the day the injured party learned who the offender was (art. 31 SCC). With an anonymous group, file early rather than argue later about when the period started.
Phishing cases raise a familiar objection, that the attacker had the password. That does not make the access lawful. The Federal Supreme Court held that logging into someone else’s password-protected email account without authorisation amounts to unauthorised access, even though the password had been found by chance on a note in a drawer (BGE 145 IV 185).
For groups and foreign parent companies
Coordinate before headquarters notifies anyone, pays anything or instructs a foreign forensic firm. The ISA reporting duty applies to cyberattacks that have an effect in Switzerland, even if the IT resources concerned are located abroad (art. 74b para. 3 ISA). The FADP applies to situations that have effects in Switzerland, even if they occurred abroad (art. 3 para. 1 FADP). Where data of people in the European Union is involved, check separately whether the GDPR applies, as its notification rules are not those of the FADP. Parties domiciled abroad must give an address for service in Switzerland in criminal proceedings, unless an international agreement allows direct service (art. 87 para. 2 CrimPC).
Key deadlines
- 24 hours. Report to the NCSC for organisations subject to the duty, from detection (art. 74e para. 1 ISA).
- 14 days. Completion of the report where information was missing (art. 16 para. 1 Cybersecurity Ordinance).
- As soon as possible. Notification of a high-risk data security breach to the FDPIC (art. 24 para. 1 FADP).
- Immediately. Notice of loss to the insurer (art. 38 para. 1 ICA).
- 3 months. Criminal complaint for offences prosecuted on complaint, once the offender is known (art. 31 SCC).
Frequently asked questions
Should a company pay a ransomware demand in Switzerland?
The federal authorities advise against it, as ransoms fund the perpetrators, and recommend consulting them before taking any step (press release of the Office of the Attorney General, fedpol and the NCSC, 16 October 2025). Paying guarantees neither the return of the data nor that it will not be published.
Is data breach notification mandatory in Switzerland?
Yes, where the breach is likely to result in a high risk to the personality or fundamental rights of the people concerned. The controller notifies the FDPIC as soon as possible, stating the nature of the breach, its consequences and the measures taken (art. 24 para. 1 and 2 FADP).
Which companies must report a cyberattack to the NCSC?
Those listed in art. 74b ISA, including banks, insurers, energy, telecommunications, cloud and data centre providers, unless an exemption applies. The deadline is 24 hours from detection. Other companies may report incidents voluntarily.
Can we file a criminal complaint against unknown hackers?
Yes, against persons unknown, with the police or the Public Prosecutor (art. 304 para. 1 CrimPC). For unauthorised access, prosecuted only on complaint, the deadline is three months from knowing the offender (art. 31 SCC). A prompt complaint makes it easier to freeze funds.
Can a fraudulent wire transfer be recovered?
Sometimes, if you act fast. Funds that will probably have to be returned to the victim can be frozen (art. 263 para. 1 let. c CrimPC), provided they are still in the receiving account. Alert the bank the same day and file a complaint immediately.
Does cyber insurance require immediate notice?
Yes. The insurer must be notified as soon as the company becomes aware of the loss. A culpable delay allows the insurer to reduce the indemnity (art. 38 para. 1 and 2 ICA).
Legal basis and case law
Federal Act on Data Protection (FADP): art. 3 and 24. Information Security Act (ISA): art. 74a, 74b, 74d, 74e, 74g and 74h. Cybersecurity Ordinance: art. 12 and 16. Swiss Criminal Code (SCC): art. 31, 143, 143bis, 144bis, 146, 147 and 156. Criminal Procedure Code (CrimPC): art. 87, 263 and 304. Insurance Contract Act (ICA): art. 38. Case law: BGE 145 IV 185.
Sources: federal cybersecurity office, annual report 2025 (16 February 2026, in French). Office of the Attorney General, fedpol and NCSC, Cybercrime, the AKIRA group steps up its activities (16 October 2025). NCSC, reporting cyberattacks on critical infrastructure mandatory from 1 April 2025 (7 March 2025). On Fedlex, FADP, ISA (French), Cybersecurity Ordinance (French), Swiss Criminal Code and Criminal Procedure Code.
About this type of case
See our page digital law and technology lawyer in Geneva and, for the criminal side, our page criminal defence lawyer in Geneva.
A first meeting, ideally in the days following the incident, lets us sort out the mandatory notifications, prepare the complaint and secure what can still be recovered. The firm handles cybercrime for victims as well as for the defence, and Matthias Traussnig has spoken on blockchain-related fraud in the CAS Digital Finance Law at the University of Geneva. See also Hacked access keys, when your AI bill explodes and Deepfakes and Swiss criminal law. To discuss your situation: +41 22 512 76 00 or use the contact form.