Sweden Cyber Watch
Reports since 1 Jan 2026. Not a live feed.
Threat level, Sweden
Background readingHacktivismIncident response
No public level found
No published national cyber threat level found for Sweden, checked 7 Nov 2026. Sweden publishes no national cyber threat level; the NCSC issues warnings and news on incidents and vulnerabilities.
Source: NCSC Sweden
From official agencies
| Date | Agency | Advisory or alert |
|---|
Agency headlines, unedited.
Compare countries
| Country | Threat level | Confirmed | Claimed only | Via a vendor | Latest report |
|---|---|---|---|---|---|
 Malaysia | Medium | 19 | 35 | 7 | 7 Nov 2026 |
 Singapore | None published | 12 | 24 | 3 | 7 Nov 2026 |
 Indonesia | None published | 6 | 32 | 0 | 5 Nov 2026 |
 Thailand | None published | 9 | 33 | 0 | 3 Nov 2026 |
 Philippines | None published | 9 | 35 | 4 | 7 Nov 2026 |
 Vietnam | None published | 5 | 34 | 0 | 5 Nov 2026 |
 Israel | None published | 4 | 2 | 0 | 7 Nov 2026 |
 Iran | None published | 4 | 0 | 0 | 13 Jun 2026 |
 United Arab Emirates | None published | 4 | 4 | 1 | 7 Oct 2026 |
 Saudi Arabia | None published | 2 | 5 | 0 | 12 Oct 2026 |
 Egypt | None published | 1 | 4 | 1 | 29 Oct 2026 |
 South Africa | None published | 8 | 0 | 1 | 26 Oct 2026 |
 Nigeria | None published | 2 | 3 | 0 | 8 Aug 2026 |
 Kenya | None published | 1 | 6 | 0 | 25 Jul 2026 |
 India | None published | 9 | 2 | 1 | 28 Oct 2026 |
 Pakistan | None published | 3 | 3 | 0 | 22 Jul 2026 |
 Bangladesh | None published | 1 | 5 | 0 | 23 Oct 2026 |
 Sri Lanka | None published | 4 | 3 | 1 | 1 Jul 2026 |
 Cambodia | None published | 0 | 3 | 0 | 10 Jun 2026 |
 Myanmar | None published | 1 | 5 | 0 | 25 Oct 2026 |
 Brunei | None published | 0 | 0 | 0 | |
 Poland | BRAVO-CRP | 5 | 0 | 4 | 1 Oct 2026 |
 Ukraine | None published | 7 | 0 | 1 | 4 Nov 2026 |
 Russia | None published | 7 | 0 | 1 | 1 Nov 2026 |
 Czechia | None published | 3 | 0 | 1 | 22 Oct 2026 |
 Romania | None published | 2 | 0 | 0 | 14 Jul 2026 |
 Estonia | None published | 5 | 0 | 3 | 4 Nov 2026 |
 Turkey | None published | 3 | 0 | 1 | 16 Sep 2026 |
 United Kingdom | None published | 5 | 1 | 3 | 2 Nov 2026 |
 Germany | None published | 4 | 0 | 1 | 2 Nov 2026 |
 France | None published | 7 | 0 | 2 | 4 Nov 2026 |
 Netherlands | None published | 5 | 1 | 1 | 2 Nov 2026 |
 Italy | None published | 5 | 0 | 0 | 7 Nov 2026 |
 Spain | None published | 3 | 0 | 0 | 5 Feb 2026 |
 Ireland | None published | 3 | 4 | 0 | 2 Nov 2026 |
| Sweden | None published | 5 | 3 | 2 | 2 Nov 2026 |
 United States | None published | 6 | 0 | 2 | 28 Aug 2026 |
 Canada | None published | 5 | 0 | 1 | 21 Aug 2026 |
 Mexico | None published | 2 | 4 | 1 | 21 Aug 2026 |
 Brazil | None published | 2 | 2 | 0 | 2 Nov 2026 |
 Argentina | None published | 1 | 2 | 0 | 4 Aug 2026 |
 Chile | None published | 1 | 2 | 0 | 2 Nov 2026 |
 Colombia | None published | 1 | 2 | 0 | 4 Nov 2026 |
 Japan | None published | 9 | 0 | 5 | 4 Nov 2026 |
 South Korea | Caution | 6 | 0 | 2 | 29 Oct 2026 |
 China | None published | 0 | 3 | 0 | 7 Aug 2026 |
 Taiwan | None published | 9 | 0 | 2 | 3 Nov 2026 |
 Hong Kong | None published | 3 | 0 | 3 | 30 Oct 2026 |
 Australia | None published | 5 | 0 | 1 | 2 Nov 2026 |
 New Zealand | None published | 7 | 2 | 1 | 3 Sep 2026 |
2026 counts. Click a row to open a country.
Official numbers
| Measure | Value | Period | Source |
|---|
Who is targeting it
Laws and rules this year
- 11 Sep 2026EU Cyber Resilience Act reporting obligations apply. Manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents from this date; the main obligations follow on 11 December 2027. Source
- 15 Jan 2026Cybersäkerhetslagen (NIS2) enters into force. Sweden's NIS2 law and ordinance took effect, with incident reporting rules from 1 July 2026 and security measure rules from 1 October 2026. Source
Full stories
- European supermarket fridges hacked in a single night Estonia, United Kingdom, Germany +5 · 3 Nov 2026
Official statements
- 5 Nov 2026NCSC relayed EU coordination on refrigeration incidents since 11 October and urged firms to patch connected control systems. NCSC Sweden
- 2 Nov 2026NCSC said it is following incidents hitting grocery refrigeration systems and is in contact with affected organisations. NCSC Sweden
Incidents
8 of 8 incidents
| What happened | Sources | |||||
|---|---|---|---|---|---|---|
 ✅ ConfirmedCoopFull story | 2 Nov 2026 | Retail | Not disclosed | None | Confirmed. Coop confirmed a cyber incident hit cooling at seven stores in Gävle and Sundsvall, which were on older 4G connections. | New Straits Times (AFP) · Sweden Herald✓ 7 Nov |
 ✅ ConfirmedICA storesVia a vendorFull story | 2 Nov 2026 | Retail | Not disclosed | None | Confirmed. Ica Kvantum Sjöbo said a cyberattack caused its cooling failure, and ICA Group said the affected stores were those using Danfoss systems. | Sweden Herald✓ 7 Nov |
 ⚠️ ClaimedSecuritas | 25 Sep 2026 | Other | Ransomware | Claimed. Everest listed Securitas Group on its leak site, said all company data was encrypted and threatened a leak. | DeXpose✓ 8 Nov | |
 ⚠️ ClaimedElectrolux | 19 Sep 2026 | Manufacturing | Data leak | Claimed. Emperador said it exported about 41 GB from an Electrolux Azure database and threatened to leak it. No company statement found. | DeXpose✓ 8 Nov | |
 ⚠️ ClaimedIngka Group (IKEA) | 2 Jun 2026 | Retail | Data leak | Claimed. Lapsus$ said it stole 180 GB of internal data including source code and architecture documents. The sample could not be independently verified. | RetailDetail✓ 8 Nov | |
| ✅ ConfirmedThermal power plant in western Sweden | 15 Apr 2026 | Energy | Intrusion | Confirmed. Civil defence minister Carl-Oskar Bohlin disclosed a failed destructive attack on a heating plant in 2025. A built-in protection mechanism blocked it. | TechCrunch✓ 8 Nov | |
| ✅ ConfirmedDorotea and Vilhelmina municipalities | 9 Apr 2026 | Government | Ransomware | Confirmed. An attack found on 9 April took down IT systems in both Västerbotten municipalities. Dorotea warned that personal data may have leaked. Claimed. INC Ransom listed Dorotea on its leak site on 24 April. | SVT · ransomware.live✓ 8 Nov | |
 ✅ ConfirmedCGI SverigeVia a vendor | 13 Mar 2026 | Government | Data leak | Confirmed. CGI said two internal test servers in Sweden were accessed and an older application version and its source code were exposed. Civil defence minister Carl-Oskar Bohlin confirmed the leak and said CERT-SE and the NCSC were involved. Claimed. ByteToBreach said it leaked source code from e-government platforms used by Swedish agencies. | Cointelegraph✓ 8 Nov |
FAQ
Does Sweden have a national cyber threat level?
No published national cyber threat level was found for Sweden (checked 7 Nov 2026). Sweden publishes no national cyber threat level; the NCSC issues warnings and news on incidents and vulnerabilities.
Which organisations in Sweden confirmed cyber incidents recently?
5 incidents confirmed since January 2026: Coop, ICA stores, Thermal power plant in western Sweden, Dorotea and Vilhelmina municipalities and CGI Sverige.
Which Sweden organisations appear on ransomware or leak sites?
3 claims, not confirmed by the organisations: Securitas, Electrolux and Ingka Group (IKEA).
What counts as a confirmed incident?
The organisation, a regulator, the police or a minister has said something happened, as reported by a named outlet. Everything else is listed as claimed.
Why list leak-site claims at all?
Ransomware and extortion crews post victims on leak sites before anyone confirms. The list shows what attackers say. Treat it as a lead and check with the organisation.
Is the map a live attack feed?
No. It counts incidents and claims reported in 2026. Live attack maps from security vendors show scanning traffic hitting their sensors, which does not mean a place was attacked.
How often is it updated?
By hand when a national level changes or a notable incident is reported. The date is shown in the header.
Sources: official statements and regional press, including Bernama, The Star, Malay Mail, CNN Indonesia and Newsbytes.PH; leak-site claims from public ransomware trackers. Each entry links its source.