Cybersecurity is no longer only an IT concern. For companies across Switzerland, Germany and Austria, a cyber incident can interrupt operations, expose sensitive information, affect customers and suppliers, and create significant financial and reputational consequences.

The threat is substantial. Switzerland’s National Cyber Security Centre (NCSC) received 64,733 voluntary cyberincident reports during 2025. In the first half of 2025 alone, it recorded 57 reported ransomware incidents, primarily affecting companies and organisations.

Germany faces similar pressure. The German Federal Criminal Police Office (BKA) recorded 950 reported serious ransomware attacks against companies and institutions in 2024. It describes ransomware as one of the defining threats in the current cybercrime environment, affecting organizations ranging from large enterprises to vulnerable SMEs.

The question for businesses is therefore increasingly not simply:

“Can we prevent every cyberattack?”

It is also:

“If something happens, can we detect it, contain it and continue operating?”

When cybersecurity becomes a business problem

Several recent incidents demonstrate how quickly an IT security problem can extend beyond the organisation initially attacked.

Xplain: one supplier, multiple organisations affected

In 2023, Swiss software provider Xplain suffered a ransomware attack in which attackers stole data and subsequently published it on the darknet. Xplain provided software to several Swiss government organisations.

The incident consequently affected data belonging to multiple federal and cantonal authorities. Swiss authorities later confirmed that the leaked material included operational data and, in some cases, sensitive personal information.

The incident illustrates an increasingly important cybersecurity concern:

Your security exposure does not stop at the boundaries of your own organisation.

Suppliers, software providers, cloud services, integrations and other third parties can form part of the same risk environment.

Following the Xplain incident, the Swiss federal government also reviewed contractual requirements for IT service providers so that cybersecurity obligations and incident-response capabilities could be strengthened.

For businesses, this highlights the value of:

• third-party and supplier risk assessments;
• clearly defined access controls;
• data classification and minimisation;
• network and system segmentation;
• monitoring of unusual activity;
• incident-response procedures;
• defined security responsibilities between suppliers and customers.

Südwestfalen-IT: when one attack affects many organisations

A ransomware attack against German municipal IT service provider Südwestfalen-IT in 2023 caused the failure of numerous IT services across municipalities in South Westphalia and beyond.

The incident demonstrates another important characteristic of modern digital infrastructure: organisations are interconnected.

A single compromised service provider can potentially cause operational disruption across many customers simultaneously.

For organisations dependent on shared infrastructure, cybersecurity therefore needs to consider not only whether an application is secure, but also:

What happens if an important infrastructure component suddenly becomes unavailable?

This is where business-continuity planning, disaster recovery, redundant infrastructure and tested restoration procedures become essential.

Ransomware remains a major concern

Ransomware attacks have also evolved.

Attackers may no longer simply encrypt files. They can first access an organisation’s network, move between systems, obtain administrative privileges, steal information and then encrypt infrastructure.

The stolen information can subsequently be used as an additional means of extortion.

Germany’s BSI specifically warns that attackers may attempt to compromise or delete backups as part of a ransomware attack. It therefore recommends maintaining appropriately separated or offline backups and regularly testing restoration procedures.

This distinction is important.

A company may have a backup.

But the more important questions are:

Can it actually restore the business from that backup?

How long would recovery take?

Can attackers access the backup from the production environment?

Has the recovery procedure ever been tested?

Cyber resilience requires answers to all four.

Cybersecurity across a more complex digital environment

Modern organisations increasingly rely on combinations of:

• cloud environments;
• internal applications;
• ERP and CRM systems;
• APIs;
• ecommerce platforms;
• remote access;
• third-party SaaS applications;
• external development partners;
• customer and supplier portals.

Every connection creates business value, but every connection can also expand the potential attack surface.

The Swiss NCSC recommends that cloud environments implement controls including encrypted communications, need-to-know access controls and multi-factor authentication. It also recommends contingency planning and offline backups to provide protection against ransomware and service disruption.

The challenge is therefore not simply to purchase another security product.

It is to understand how all of these systems interact and where the critical risks actually exist.

How we can help

We help organisations evaluate their digital environments from both a software-engineering and cybersecurity perspective.

Our objective is to identify weaknesses before they become operational problems and to design systems that can continue functioning even when individual components are compromised.

Cloud security and architecture reviews

Cloud platforms can provide extensive security capabilities, but they must be configured correctly.

We can examine areas such as:

• cloud architecture;
• network configuration;
• permissions and identities;
• exposed services;
• encryption;
• secrets management;
• logging;
• infrastructure configuration;
• backup and recovery architecture.

The objective is to identify unnecessary exposure and establish a clearer security architecture.

Identity and access management

Compromised credentials remain an important route into corporate infrastructure.

Access should therefore follow the principle that users and systems receive only the permissions they actually require.

This can include:

• multi-factor authentication;
• role-based permissions;
• privileged-access controls;
• service-account management;
• credential and API-key management;
• access reviews;
• removal of unused accounts.

Swiss cybersecurity guidance specifically recommends multi-factor authentication and need-to-know access controls for cloud environments.

Monitoring and threat detection

Prevention alone is insufficient.

Organisations also need to recognize when something unusual is happening.

Monitoring can help identify events such as:

• abnormal login activity;
• unusual administrative access;
• unexpected data transfers;
• suspicious network activity;
• changes to critical files;
• attempts to disable backups;
• abnormal infrastructure behaviour.

The German BSI, for example, recommends monitoring remote-access activity and suspicious attempts to manipulate or delete backups as part of ransomware detection.

Early detection can significantly improve an organisation’s ability to isolate affected systems before an incident spreads.

Backup and disaster recovery

Backups should be considered part of security architecture rather than simple data storage.

The BSI describes backups as one of the most important measures for restoring data availability after ransomware incidents and recommends that organisations maintain separated backups and regularly practise restoration.

We can help organisations examine:

• what needs to be backed up;
• where those backups are stored;
• whether production systems can modify them;
• how frequently backups occur;
• recovery-point and recovery-time objectives;
• whether restoration has been tested;
• how critical systems can be restarted after a major incident.

The goal is simple:

A backup should not merely exist. It should enable the company to recover.

Secure software development

Cybersecurity should also begin before software reaches production.

Security can be incorporated into development through:

• automated dependency scanning;
• vulnerability management;
• secure code review;
• infrastructure-as-code validation;
• automated security testing;
• secret detection;
• controlled deployment processes;
• software lifecycle management.

This reduces the likelihood that vulnerabilities are introduced or remain unnoticed throughout the development lifecycle.

Infrastructure hardening

Many environments accumulate unnecessary services, permissions and legacy configurations over time.

Infrastructure hardening can include reviewing:

• publicly exposed systems;
• outdated software;
• unused ports and services;
• administrative privileges;
• network segmentation;
• operating-system configuration;
• patch management;
• firewall policies.

The objective is to reduce the number of opportunities available to an attacker.

Third-party and supply-chain security

The Xplain incident provides a useful reminder that suppliers form part of the cybersecurity environment.

Companies should therefore understand:

• which suppliers process sensitive information;
• which systems suppliers can access;
• how credentials are managed;
• where company information is stored;
• how quickly suppliers must report an incident;
• whether access can be isolated if necessary;
• what happens when the supplier becomes unavailable.

Security architecture increasingly needs to include the ecosystem around the organisation, not simply the organisation itself.

From cybersecurity to cyber resilience

No architecture can guarantee that an organisation will never experience a cyber incident.

A more realistic objective is to build an organisation that can:

Protect → Detect → Contain → Recover → Continue operating

That requires technology, but it also requires clear processes, responsibilities and preparation.

The BSI recommends continuous assessment of cyber risks, protection of particularly important information, tested backups and regular employee awareness measures as fundamental elements of corporate cybersecurity.

For companies operating critical digital services, the ability to recover quickly can be just as important as the ability to prevent an attack.

Building security into the architecture

Cybersecurity works best when it is designed into systems rather than added after development is complete.

By combining software engineering, cloud infrastructure, security architecture, monitoring and recovery planning, organisations can reduce their exposure while becoming better prepared for unexpected events.

For companies across the DACH region, this means moving beyond the question:

“Are we secure?”

toward a more useful one:

“Are we prepared?”

---

Sources

Swiss National Cyber Security Centre (NCSC/BACS)
Cybersecurity situation reports and guidance for Swiss organisations.
NCSC Semi-Annual Report 2025/I
NCSC Semi-Annual Report 2025/II
NCSC information on the Xplain incident

Swiss Federal Police (fedpol)
Information about the effects of the Xplain ransomware incident and measures subsequently taken.
fedpol: Xplain attack and measures taken

German Federal Office for Information Security (BSI)
Guidance concerning ransomware prevention, detection, backups and corporate cybersecurity.
BSI ransomware measures and backup guidance

German Federal Criminal Police Office (BKA)
German federal cybercrime situation reporting.
BKA Cybercrime 2024 situation report announcement

European Union Agency for Cybersecurity (ENISA)
The ENISA Threat Landscape 2025 analysed 4,875 cybersecurity incidents occurring between July 2024 and June 2025, providing broader European context for the threats facing public and private organisations.
ENISA Threat Landscape 2025