Swiss Study Links Shadow IT Accounts to Ransomware Victims
1Four in Five Swiss Ransomware Victims Had Work Addresses in Data Leaks
Four in five Swiss organizations publicly named as ransomware victims had work email addresses in data leaks. That is the main finding of a study the Austrian security company Risikomonitor published on October 12, 2026, with the Swiss security conference Swiss Cyber Storm. Risikomonitor sells monitoring of leaked company data. Among Swiss company websites that list their owner, the share was one in six. The authors read the leaks as a trace of shadow IT. Accounts the IT team never recorded also slip past offboarding when their owner leaves, a step a U.S. health regulator listed as a potential violation in September.
The more company login credentials turn up in data leaks, the more often a company falls victim to ransomware. Website weaknesses, by contrast, hardly play a role.
Risikomonitor, study announcement on its website (translated from German)
The authors compared public data on all .ch domains with publicly known ransomware cases. The more work addresses a company had in leaks, the likelier it was to be hit. The study calls this a link without proof of cause. Victims are mostly larger organizations with more staff and more addresses. Some signals were also measured after the attack.
2Shadow IT Leaves Traces Outside the Company
Shadow IT covers the services staff use with a work address without the IT team's approval or knowledge, such as a private Dropbox or an online tool. When such a service is breached, the work address ends up in traded data collections. Business software and cloud services touched more .ch domains than any other type of service. According to the authors, 160 companies that have not been named as victims share the risk profile of those that were.
When company addresses turn up in the leaks of outside platforms, that is hard evidence of shadow accounts: employees use work identities on services the IT team does not know about.
Risikomonitor.com GmbH, Studie CH-02, Schatten-IT der Schweiz 2026 (translated from German)
3Website Flaws Barely Explain the Difference
Victims had website security flaws and open server ports as often as other companies. The canton of Uri has the highest share of websites with known flaws and not one publicly named ransomware case. Publicly named cases are rising, with more in 2026 by mid-October than in all of 2025. The counts rest on attackers' own public claims, which the authors note are not confirmed in every case.
Source: Risikomonitor.com GmbH, Studie CH-02, Schatten-IT der Schweiz 2026, Stichtag 2026-10-11.