Executive Summary
Cyber attacks in Sweden rose 73% in September 2026 compared with the same month last year, according to figures Check Point Software Technologies published on 12 October. Swedish organisations faced an average of 3,103 attacks a week during the month. Healthcare has overtaken the public sector as the most targeted sector in Sweden with telecoms in third place. Across the Nordics the increase was 67%, ahead of the European average of 61% and the global average of 48%. The figures are based on data Check Point collects from its own services. The release gives no separate numbers for Norway, Denmark or Finland.
Healthcare Now the Top Target for Cyber Attacks in Sweden
The ranking changed within two months. Check Point’s July figures, reported by SecurityWorldMarket, put the public sector first in Sweden, followed by finance and then healthcare. By September healthcare had climbed to the top and the public sector had dropped to second. Check Point did not publish a weekly attack figure for Swedish healthcare.
“Of particular concern is that healthcare is now Sweden’s most targeted sector,” Oskar Rödin, a security expert at Check Point Software, said in the Swedish press release (translated). He added that these organisations handle sensitive information and that an attack on them can have serious consequences.
Sweden’s Weekly Average Since June
Check Point’s monthly figures for cyber attacks in Sweden have climbed since early summer. In June the company counted 2,432 attacks a week, up 40% on a year earlier, as ITBranschen reported in early July. July came in at 2,352 a week, up 36%, which Check Point said was the highest increase in the Nordics and the second highest in Europe after Germany. September’s 3,103 is the highest of the three. That is 751 more attacks a week than in July.
No August figure for Sweden appeared in the coverage eBuilder reviewed.
Swedish Numbers Absent From the Global Report
Check Point Research published its global September report on 8 October. It breaks figures out by region and sector but not by country. The Swedish and Nordic numbers appear only in the Swedish-language release distributed four days later.
Globally, organisations faced 2,803 attacks a week in September, up 16% on August and 48% on September 2025. Education was the most targeted sector at 6,656 weekly attacks per organisation. Check Point counted 824 ransomware attacks, 53% more than a year earlier, drawing that figure from double-extortion groups’ leak sites. The Gentlemen accounted for 13% of published attacks, ahead of Qilin at 9% and Akira at 5%. One in every 91 emails was classified as phishing, up from one in 112 in August.
The Gentlemen is the group that published data from the gym chain Sats after an attack on 14 March, according to TV4 and Göteborgs-Posten.
What the Release Leaves Out
Check Point does not say how many Swedish organisations the figures cover or how it defines an attack. The healthcare count is missing and the ransomware total is global only with no Swedish victims listed. Nor does the release name any Swedish incident behind the trend.
A Third More Weekly Attacks Than in July
Set against Check Point’s own July figure, the Swedish weekly average rose by about a third in two months from 2,352 to 3,103. Healthcare moved from third to first over the same period. These are a vendor’s counts, not incidents reported to CERT-SE. Healthcare providers covered by the cybersäkerhetslagen, the Swedish NIS2 law in force since 15 January 2026, have also been subject since 1 October to regulations that set out required security measures and management training (MCFFS 2026:11).
References
- Cyberattackerna ökar kraftigt i Norden
- September 2026: Global Attacks Jump 48% as Phishing and GenAI Data Exposure Rise
- Föreskrifter om säkerhetsåtgärder träder i kraft
- Kraftig ökning av cyberattacker i Sverige
- Cyberattacker mot svenska verksamheter ökar mest i Norden
- Cyberattacks against Swedish businesses increased by 40 percent in June
- Cyberattackerna mot svenska verksamheter ökade 36 procent
- Uppgifter läckta på darknet efter ökända gruppens it-attack
This post is also available in:
Svenska
Related News
Fake 1177 Emails Push Discounts And Calendar Invites To Swedish Patients
Fraudsters are sending emails in the name of 1177, Sweden's national healthcare service, offering discounts on services and planting invitations in recipients' calendars. The warning…
October 6, 2026 
NCSC Phishing: Fake Court Warnings Carry John Billow’s Name
October 5, 2026 
Brevo Supply Chain Attack Injected ClickFix Malware Into Customer Websites
Attackers spent roughly four hours on 14 September rewriting Brevo’s JavaScript as it left Cloudflare’s edge, without touching a single file on Brevo’s servers. The…
September 18, 2026 One Phone Call Put ShinyHunters Inside ReliaQuest’s Okta Dashboard
On 22 August an attacker phoned several employees at ReliaQuest, an American managed detection and response provider, and presented themselves as a named member of…
August 26, 2026