In Denmark, around 8.8 million records were stolen from the central population register. In France, the freezers and fridges of several hundred stores were suddenly switched to defrost. Two distant episodes, and one question that links them: why are cyberattacks multiplying?

Between the end of September and mid-October, the list of organisations successfully breached grew so long that it is hard to keep track of. Seen one by one, each intrusion comes as little surprise. Put together, the picture changes.

Switzerland: pension funds, companies and a magazine

The federal pension fund Publica was targeted through PK Softech, a software supplier, using malicious programmes. Salary data, retirement savings, account numbers, addresses, social security numbers and information about spouses may have been taken. The pension fund of the city of Zurich was also hit.

Beyond Gravity, a state-owned space company, suffered a targeted attack, presumably carried out by a highly sophisticated group. It is not known how the attackers got in, and the data taken has not been precisely identified. Internal sources, cited by the media, point to China, but nothing has been officially confirmed.

The digital magazine Republik says it was broken into through a flaw in Metabase, a data analysis tool. A security update fixing the problem had been available since 6 August 2026, but the publication did not install it in time. Email addresses and the names of current and former readers were obtained, and in some cases phone numbers, birth years and gender. Credit card data was not affected.

At SRG, the Swiss public broadcaster, attackers reached the data of around 340 people, current and former employees. Names, job titles and 2020 contact details, some of them personal, are involved. SRG says there is no evidence the data has been made public, and no sign that passwords, financial information or details about journalistic sources were taken.

Denmark: a weak password

In Denmark, the route in was a legitimate interface belonging to a private IT company that had access to the register. At least three accounts of that company used the password "123456". Around 8.8 million records are involved. The CPR number works as a universal identifier across public services, banks and hospitals in the country, which makes the theft especially sensitive.

More cases, more methods

The online retailer Ricardo saw its servers accessed after attackers exploited a security vulnerability. Names, addresses and phone numbers of around 890,000 accounts were compromised. Passwords and email addresses were not touched. Later, some customers received WhatsApp messages that addressed them by name and gave their real address, before directing them to a fake website. Whether these messages are linked to the intrusion remains unconfirmed.

ASOS, the British online fashion retailer, suffered a social engineering attack: attackers tricked an employee into handing over their credentials and used them to log in to third-party platforms. Names, addresses, phone numbers, email addresses and the search histories of millions of customers were taken. Payment data and passwords were kept safe.

In the case of Discord, the platform itself was not compromised, but Double Counter, a security service used on it. According to the press, the attackers got into the cloud infrastructure of that company through a forgotten server and took control of its bot. In some cases, identifiers, usernames and IP addresses of up to 28 million accounts were taken, along with about one million email addresses.

Finally, Revolut. Hackers took control of an official communication channel of an Italian government body and used it to pose as police. They pressured the bank to cooperate in a supposed investigation. Convinced the request was genuine, the bank handed over data on almost 700 customers, including passport information, account numbers and addresses. No money was stolen. According to the media, most of the affected customers live in Switzerland.

Are there really more attacks?

The numbers point that way. The cybersecurity company Check Point recorded, in September 2026, 48% more attack attempts worldwide than in the same month of 2025.

There is, however, a factor that may inflate the perception. The European rules NIS2 and DORA oblige organisations to report more incidents to the authorities, and some choose to inform the public too. In Switzerland, since 1 April 2025, critical infrastructure operators have had a legal duty to report cyberattacks. More reporting means more news, even if that alone does not prove there were more attacks.

What lies behind it

The explanation most often repeated is artificial intelligence. Bill Gates recently warned of an "escalation of cyberattacks driven by artificial intelligence". The Swiss Federal Council, in its "Report on the impact of artificial intelligence on cybersecurity", had already warned at the end of 2025 that AI would increase the volume of attacks. At Threema, the bug bounty programme for identifying vulnerabilities shows a rise in reports that closely follows the advances of this technology. For the company, AI's influence is already a given, above all because it makes attacks easier, faster and simpler to repeat at scale.

The attack surface is also growing. There are more and more online services, and they are increasingly complex, opening more doors. There are also dependencies: Publica and Republik were hit by supply chain attacks, in which the attacker first looks for a weak link in a technology supplier, rather than attacking the organisation directly.

And now?

AI also serves defence. Many companies, however, use it only to gain efficiency in daily work, and that use can, without intention, open new doors, just as poorly chosen chat services can. Online services should undergo professional security audits, which can also use AI models to find flaws.

No audit guarantees full protection, because absolute security does not exist. That is why the most solid approach remains "Privacy by Design": collecting from the start only the data that is technically essential. Data that was never collected cannot be stolen.

A fridge can be switched back on. A stolen personal record does not become private again. The greater risk, perhaps, is that, from hearing so much about breaches, we stop feeling the value of privacy on the internet.