Hit by a cyberattack? Act quickly and
with focus!

Recent cyberattacks in Switzerland have affected pension funds, online retailers, healthcare providers and refrigeration systems. By the end of October, the Swiss National Cyber Security Centre (NCSC) had received 389 mandatory reports from critical infrastructure operators in 2026.

Many cases show that your supplier's incident can quickly become your own.

What to do in the first phase of a cyberattack:

• Activate your crisis team and incident response plan, using secure channels outside possibly compromised systems.
• Contain the attack but preserve evidence. Bring in forensic specialists early to secure logs, system images and attacker communications before rebuilding systems, without delaying urgent containment.
• Bring in outside counsel to preserve legal privilege.
• Notify your cyber insurer early; coverage often depends on it.
• Protect critical operations and backups.
• Find out which systems, data and individuals are affected, including whether data have been stolen or altered. Consider darknet monitoring for publication of stolen data.
• Hit through a supplier? Demand prompt, regular updates and relevant evidence, coordinate containment and communications, and preserve contractual rights.
• Check the thresholds for notifications required by law (to regulators and affected individuals) or by contract (to customers, suppliers and other business partners) and notify within the deadlines.
• Inform employees promptly and prepare external communications, including for media enquiries. Decide on proactive public statements. State verified facts; avoid speculation or premature conclusions about scope, cause or responsibility.
• Faced with a demand for ransom payment? Take no decision without prior legal advice: Payment can involve criminal and sanctions risks.
• Document key decisions and risk assessments from the outset.

After the first phase, keep updating assessments and notifications, preserve claims and evidence of loss, and address the root cause. Test improvements to controls, supplier oversight and response plans.