What’s behind the current wave of cyberattacks?
Over the past few days and weeks, numerous cyberattacks have made headlines. In Switzerland alone, pension funds, the Swiss Broadcasting Corporation (SRG), and the online magazine “Republik” have been affected. In Denmark, 8.8 million personal records were stolen from the central population register, while in France, hackers shut down refrigerators in about 150 supermarkets. What’s behind this surge in attacks?
Anyone who has been following the news lately has had a hard time avoiding reports of cyberattacks. Taken individually, these incidents may no longer come as much of a surprise, but taken together, it is striking how many organizations have fallen victim to successful attacks in such a short time.
Here’s a selection of the most significant incidents from late September through mid-October:
Publica, federal pension fund: Attackers targeted its software vendor, PK Softech, with malware. Salaries, retirement savings, account numbers, addresses, social security numbers, and spousal information may have been stolen. The City of Zurich’s pension fund was also affected. 🔗🔗
Beyond Gravity, Swiss space company: A targeted attack hit the government-owned company, presumably carried out by a highly sophisticated actor. It is unclear how the attackers gained access. Data appears to have been stolen, though it is not known which data. According to media reports, Internal sources suspect China is behind the attack, but this has not been officially confirmed. 🔗
Ricardo, online marketplace: Attackers exploited a security vulnerability to access company servers. Names, addresses, and phone numbers from about 890,000 user accounts were compromised. Email addresses and passwords were not affected. Customers later received phishing messages on WhatsApp. The messages greeted recipients by name and cited their real addresses, then directed them to a fake website. Whether they are linked to the breach remains speculation. 🔗
Republik, online magazine: According to “Republik,” attackers got in through a security vulnerability in Metabase, an analytics tool. A patch for the flaw had been available since August 6, 2026, but the magazine did not install it in time. The attackers obtained the email addresses and names of active and former readers, and in some cases their phone numbers, birth years, and genders. Credit card information was not compromised. 🔗
SRG, Swiss public broadcaster: Attackers gained access to data on about 340 current and former employees. The stolen data includes names, job titles, and contact details from 2020, some of them private. According to SRG, there is no evidence that the data has been made public. There are also no indications that passwords, financial data, or journalistic sources were stolen. 🔗
Denmark’s central population register (CPR): Attackers exploited a legitimate interface of a private Danish IT company that has access to the register. At least three of the company’s accounts used the password “123456.” About 8.8 million records were stolen. The CPR number is the universal identifier at Danish government agencies, banks, and hospitals. 🔗
ASOS, British online fashion retailer: Attackers used social engineering to obtain an employee’s login credentials, then used them to access third-party platforms. The stolen data includes names, addresses, phone numbers, email addresses, and search histories of millions of customers. Payment data and passwords were not affected. 🔗
Discord, chat platform: Attackers breached Double Counter, a security service used on Discord, not Discord itself. According to media reports, they got into Double Counter’s cloud infrastructure through a forgotten server and took over its bot. The stolen data includes, in some cases, Discord IDs, usernames, and IP addresses from up to 28 million accounts, along with about one million email addresses. Passwords and credit card data were not affected. 🔗
Various French supermarket chains: Attackers switched the refrigerators and freezers in several hundred stores to defrost mode. The attack targeted a Danish software vendor that several of the chains work with. Large quantities of food had to be thrown away. 🔗
Are cyberattacks on the rise?
Available data confirms the impression that the number of cyberattacks is increasing. For example, the cybersecurity company Check Point recorded 48% more attack attempts worldwide in September 2026 than in the same month a year earlier.
In addition, expanded reporting requirements, such as those under NIS2 and DORA in the EU, could indirectly lead to more media coverage. Companies reporting incidents to the authorities may also choose to inform the public for transparency reasons, potentially resulting in more news reports about cyberattacks.
Since April 1, 2025, Switzerland has a legal requirement to report cyberattacks on critical infrastructure. Regardless of whether the number of incidents has actually increased, the new reporting requirement could lead to higher numbers in incident statistics.
What explains the increase?
One plausible explanation is that the rise in attacks is the result of increasingly powerful AI models being used by cybercriminals. Bill Gates, for example, recently warned of an “escalation in AI-powered cyberattacks.” And in its “Report on the Impact of Artificial Intelligence on Cybersecurity,” (in German), the Swiss Federal Council already noted in late 2025 that AI will increase the volume of cyberattacks.
Of course, the ongoing digitalization of more and more areas of life also widens the attack surface and provides attackers with more targets. Moreover, not only are there more and more online services, but they are also becoming increasingly complex, potentially creating more entry points for attackers.
In particular, critical dependencies can arise when services rely on other services, which, in turn, may rely on others. For example, Publica and Republik fell victim to a so-called “supply chain attack.” In such an attack, hackers first go after a weak link in the target’s IT supply chain rather than directly after the company.
That said, the significant influence of AI in this context can be taken as a given, especially since AI makes attacks easier, more efficient, and more scalable. In our bug bounty program, for example, we are also seeing a significant rise in submitted reports whose timing coincides quite closely with advances in AI technology.
What should be done?
In general, AI is available to both sides – not just attackers. However, many companies use AI solely to improve efficiency in their day-to-day operations. Incidentally, this can inadvertently create additional entry points for attackers (much like the use of unsuitable chat services). AI can, of course, also be used to secure a company’s own systems. Online services, in particular, are advised to undergo professional security audits, which may themselves use AI models to detect vulnerabilities.
However, even the most thorough security audits cannot guarantee 100% security – because there’s no such thing. That is why the best approach remains to follow the principle of “Privacy by Design” and collect only as much data as is technically necessary from the outset. After all, the only way to ensure that data cannot be exploited is to avoid collecting it in the first place.
Threema can be used anonymously, i.e., without providing personal data such as a phone number or email address. The other ways in which data minimization is implemented in Threema are documented here.
The theft of large amounts of personal data in the recent wave of cyberattacks is a serious violation of the privacy of everyone affected. Worse still, as such attacks become more frequent, we risk becoming desensitized to data breaches and losing sight of just how important online privacy is.
