Reporting a cyberattack within 24 hours in Switzerland

Who has to report

The rule is in the Information Security Act (ISA, articles 74a onwards). Article 74b has a long list: cantons and municipalities, universities, hospitals, energy, water and waste companies, banks and insurers, transport, telecoms, postal services, suppliers of everyday essentials. Cloud providers, data centres and e-commerce platforms are there too, if they have many users in Switzerland or matter a lot to its digital economy.

A private company outside that list has no duty. It may still hear about it: a municipality or energy company that has to report within 24 hours needs to know right away what happened on the system you run for them.

Deadlines and fines

• 24 hours from discovery to report to the Federal Office for Cybersecurity (formerly the NCSC);
• 14 days to complete any missing information;
• reports go through the Cyber Security Hub form, or by email if you don't want to register;
• fines of up to CHF 100,000 since 1 October 2025, with the office contacting the company first.

The report has to say which infrastructure was hit, the type of attack, how it was carried out, its effects and what you plan to do next. In the first six months the office received 164 reports, led by DDoS (18.1%), hacking (16.1%) and ransomware (12.4%).

Where the 24 hours go

Mostly on working out what happened. If logs sit only on the attacked server, the attack takes them too. If nobody gets an alert, the clock starts the next morning, and an attack that stayed hidden for more than 30 days has to be reported for that reason alone. Then there's the most basic question: who has access, and who's reachable on a Saturday night?

What I do

• an inventory of servers, websites, business software and remote access, with who manages what;
• logs copied off the server, so they can still be read after an attack;
• alerts on changed files and admin logins with SitePing;
• encrypted backups kept away from the server, with a dated restore test;
• a one-page procedure: who calls whom, where the data for the report is, who sends it.

I work on what I know: Linux servers, websites, web business apps. Company networks, firewalls and Windows workstations stay with whoever looks after them today. If your site has already been attacked, see hacked WordPress site.

What I don't do

I don't decide whether the duty applies to your company, and I don't file the report for you. This page summarises the act and federal guidance as read on 31 October 2026 and is not legal advice. If you also have an office in Italy, NIS2 applies there.

Frequently asked questions

We're a small company. Does this apply to us?

The federal SME portal gives an exemption for companies in critical sectors with fewer than 50 employees and annual turnover or balance sheet below CHF 10 million. The Cybersecurity Ordinance may set different rules for your sector, so if in doubt ask the federal office.

We supply software to a hospital or an energy company. Are we in scope?

Possibly. Article 74b names makers of hardware and software used by critical infrastructure, where the product has remote maintenance access or serves purposes such as plant control, medical devices or IT security. Check your case against the act and the ordinance.

Do I have to report every attempt the firewall blocks?

No. Article 74d lists the cases: operation compromised, an attack by a foreign state, information leaked or manipulated, an attack undetected for more than 30 days. Anything involving extortion, threats or coercion must always be reported.

If personal data is involved, is reporting to the cybersecurity office enough?

No, those are two separate routes. With a high risk to people you also have to notify the data protection commissioner under article 24 of the Data Protection Act, as soon as possible. Banks and insurers have their own duties towards FINMA as well.

If you are in Ticino or elsewhere in Switzerland

I work from Rovellasca, near Como, between Milan and the Swiss border, and part-time at a communication agency in Switzerland. For a Swiss company I built the AREAVISION website, business app and mobile app.

Read more

• The service: Hacked sites and security
• Work of this kind: SitePing
• More pages like this: Rules to comply with in Switzerland