Sweden — Cyber Threat Profile
Sweden is consolidating its cybersecurity architecture under the National Cybersecurity Strategy 2025-2029: by 1 July 2026 the signals-intelligence agency FRA absorbs the operational cyber duties long held by the civil-contingencies agency MSB, and a new Cybersecurity Act (2025:1506) transposing the EU's NIS2 directive took effect 15 January 2026. Ransomware remains the dominant threat: in late August 2025 an attack on IT supplier Miljodata paralysed HR systems at roughly 200 of Sweden's 290 municipalities and some of its 21 regions, exposing sick-leave and medical-certificate data. Sweden continues to report elevated Russian-linked hybrid activity since its NATO accession on 7 March 2024.- National CERT/CSIRT: CERT-SE
- Data protection authority: Integritetsskyddsmyndigheten (IMY) (source: CNIL)
- World Cybercrime Index 2024 (origin significance): 0.21 / 100, #71 worldwide
- Secure Internet servers per 1M people (2024): 55,097.3 (source: World Bank)
- Internet users (2025): 95.8% of population (source: World Bank)
Threat actors targeting Sweden
- Anonymous Sudan Hacktivist
- APT28 APT
- NoName057(16) Hacktivist
- ZIRCONIUM APT
- Qilin Ransomware · 11 incident(s)
- Akira Ransomware · 10 incident(s)
- Play Ransomware Ransomware · 10 incident(s)
- The Gentlemen Ransomware · 8 incident(s)
- 8Base Ransomware · 7 incident(s)
- RansomHub Ransomware · 6 incident(s)
- DragonForce Ransomware · 5 incident(s)
- INC Ransom Ransomware · 5 incident(s)
- Lynx Ransomware Ransomware · 5 incident(s)
- Dire Wolf Ransomware · 4 incident(s)
- Fog Ransomware Ransomware · 3 incident(s)
- LockBit Ransomware · 3 incident(s)
- Black Basta Ransomware · 2 incident(s)
- Cl0p Ransomware · 2 incident(s)
- Deadlock Ransomware · 2 incident(s)
- RansomHouse Ransomware · 2 incident(s)
- Sarcoma Ransomware · 2 incident(s)
- ShinyHunters Ransomware · 2 incident(s)
- World Leaks Ransomware · 2 incident(s)
- BianLian Ransomware · 1 incident(s)
- BlackByte Ransomware · 1 incident(s)
- Cactus Ransomware · 1 incident(s)
- Coinbase Cartel Ransomware · 1 incident(s)
- Exfil Squad Ransomware · 1 incident(s)
- FunkSec Ransomware · 1 incident(s)
- Hunters International Ransomware · 1 incident(s)
- Lamashtu Ransomware · 1 incident(s)
- LAPSUS$ Hacktivist · 1 incident(s)
- Medusa Ransomware Ransomware · 1 incident(s)
- Meow Ransomware · 1 incident(s)
- NightSpire Ransomware · 1 incident(s)
- Panzer Ransomware · 1 incident(s)
- SafePay Ransomware · 1 incident(s)
- Settra Ransomware · 1 incident(s)
- Killnet Hacktivist
Most targeted sectors
- Manufacturing 33 incident(s)
- Technology 12 incident(s)
- Business & Professional Services 11 incident(s)
- Government & Public Sector 7 incident(s)
- Transportation & Logistics 7 incident(s)
- Healthcare 6 incident(s)
- Hospitality & Tourism 6 incident(s)
- Construction 4 incident(s)
- Retail & Consumer 4 incident(s)
- Education & Research 3 incident(s)
- Energy & Utilities 2 incident(s)
- Financial Services 2 incident(s)
Recent claimed incidents
- Semper Laser 2026-09-07 · Manufacturing
- Edacentrum 2026-09-06
- THQ Nordic 2026-08-30 · Technology
- Elekta AB 2026-08-28 · Healthcare
- avkvalves.com 2026-08-21 · Manufacturing
- Roadvision Systems 2026-08-19 · Transportation
- Lifesum 2026-08-19 · Healthcare
- Wishfully Studios 2026-08-17 · Technology
- Axson Teknik 2026-08-07 · Manufacturing
- Depona 2026-08-07 · Technology
- Krafman 2026-07-31 · Manufacturing
- Bonava 2026-07-26 · Manufacturing
- Carrier AB 2026-07-25 · Manufacturing
- Byggelit Sverige 2026-07-16 · Construction
- Svensk Direktreklam 2026-07-16 · Business Services