# Swiss Study Links Shadow IT Accounts to Ransomware Victims

_Four in five Swiss organizations named as ransomware victims had work email addresses in data leaks, finds a Risikomonitor study with Swiss Cyber Storm, published October 12, 2026. Among company websites that list their owner, it was one in six. The link is statistical, without proof of cause._

By Johannes Keienburg, CEO & Founder  
Published: 2026-10-13  
Source: https://www.cakewalk.security/blog/swiss-shadow-it-leaked-addresses-ransomware

---

## Four in Five Swiss Ransomware Victims Had Work Addresses in Data Leaks

Four in five Swiss organizations publicly named as ransomware victims had work email addresses in data leaks. That is the main finding of a study the Austrian security company Risikomonitor published on October 12, 2026, with the Swiss security conference Swiss Cyber Storm. Risikomonitor sells monitoring of leaked company data. Among Swiss company websites that list their owner, the share was one in six. The authors read the leaks as a trace of [shadow IT](/glossary/shadow-it). Accounts the IT team never recorded also slip past offboarding when their owner leaves, a step a [U.S. health regulator listed as a potential violation](/blog/hipaa-ambry-genetics-access-termination-settlement) in September.

> The more company login credentials turn up in data leaks, the more often a company falls victim to ransomware. Website weaknesses, by contrast, hardly play a role.

_Risikomonitor, study announcement on its website (translated from German)_

The authors compared public data on all .ch domains with publicly known ransomware cases. The more work addresses a company had in leaks, the likelier it was to be hit. The study calls this a link without proof of cause. Victims are mostly larger organizations with more staff and more addresses. Some signals were also measured after the attack.

## Shadow IT Leaves Traces Outside the Company

Shadow IT covers the services staff use with a work address without the IT team's approval or knowledge, such as a private Dropbox or an online tool. When such a service is breached, the work address ends up in traded data collections. Business software and cloud services touched more .ch domains than any other type of service. According to the authors, 160 companies that have not been named as victims share the risk profile of those that were.

> When company addresses turn up in the leaks of outside platforms, that is hard evidence of shadow accounts: employees use work identities on services the IT team does not know about.

_Risikomonitor.com GmbH, Studie CH-02, Schatten-IT der Schweiz 2026 (translated from German)_

## Website Flaws Barely Explain the Difference

Victims had website security flaws and open server ports as often as other companies. The canton of Uri has the highest share of websites with known flaws and not one publicly named ransomware case. Publicly named cases are rising, with more in 2026 by mid-October than in all of 2025. The counts rest on attackers' own public claims, which the authors note are not confirmed in every case.

> An account someone opens on an outside service with a work address exposes the company, whether or not anyone approved it. A company can govern only the apps it knows about. Cakewalk's App Discovery uses a browser extension that captures access metadata, never passwords, for the apps people open where the extension runs. Each app found this way needs an owner and a place in the next access review. An account opened on a personal device or abandoned years ago stays outside that view.

_Comment from Gil Röder, CPO & Co-Founder_

Source: Risikomonitor.com GmbH, Studie CH-02, [Schatten-IT der Schweiz 2026](https://risikomonitor.com/news/schatten-it-cybercrime-schweiz-2026), Stichtag 2026-10-11.