Sweden — Cyber Threat Profile
Sweden is consolidating its cybersecurity architecture under the National Cybersecurity Strategy 2025-2029: by 1 July 2026 the signals-intelligence agency FRA absorbs the operational cyber duties long held by the civil-contingencies agency MSB, and a new Cybersecurity Act (2025:1506) transposing the EU's NIS2 directive took effect 15 January 2026. Ransomware remains the dominant threat: in late August 2025 an attack on IT supplier Miljodata paralysed HR systems at roughly 200 of Sweden's 290 municipalities and some of its 21 regions, exposing sick-leave and medical-certificate data. Sweden continues to report elevated Russian-linked hybrid activity since its NATO accession on 7 March 2024.- National CERT/CSIRT: CERT-SE
- Data protection authority: Integritetsskyddsmyndigheten (IMY) (source: CNIL)
- World Cybercrime Index 2024 (origin significance): 0.21 / 100, #71 worldwide
- Secure Internet servers per 1M people (2024): 55,097.3 (source: World Bank)
- Internet users (2025): 95.8% of population (source: World Bank)
Latest Sweden coverage
- Extortion crew turns on Sweden: architects and a care home 2026-10-18 · Cyber Incidents
Threat actors targeting Sweden
- Anonymous Sudan Hacktivist
- APT28 APT
- NoName057(16) Hacktivist
- ZIRCONIUM APT
- Qilin Ransomware · 13 incident(s)
- Akira Ransomware · 10 incident(s)
- Play Ransomware Ransomware · 10 incident(s)
- The Gentlemen Ransomware · 10 incident(s)
- Wallstreet Ransomware · 10 incident(s)
- 8Base Ransomware · 7 incident(s)
- INC Ransom Ransomware · 6 incident(s)
- RansomHub Ransomware · 6 incident(s)
- DragonForce Ransomware · 5 incident(s)
- Lynx Ransomware Ransomware · 5 incident(s)
- Dire Wolf Ransomware · 4 incident(s)
- Fog Ransomware Ransomware · 3 incident(s)
- LockBit Ransomware · 3 incident(s)
- Black Basta Ransomware · 2 incident(s)
- Cl0p Ransomware · 2 incident(s)
- Deadlock Ransomware · 2 incident(s)
- Emperador Ransomware · 2 incident(s)
- RansomHouse Ransomware · 2 incident(s)
- Sarcoma Ransomware · 2 incident(s)
- ShinyHunters Ransomware · 2 incident(s)
- World Leaks Ransomware · 2 incident(s)
- BianLian Ransomware · 1 incident(s)
- BlackByte Ransomware · 1 incident(s)
- Cactus Ransomware · 1 incident(s)
- Coinbase Cartel Ransomware · 1 incident(s)
- Everest Ransomware · 1 incident(s)
- Exfil Squad Ransomware · 1 incident(s)
- FulcrumSec Ransomware · 1 incident(s)
- FunkSec Ransomware · 1 incident(s)
- Hunters International Ransomware · 1 incident(s)
- Lamashtu Ransomware · 1 incident(s)
- LAPSUS$ Hacktivist · 1 incident(s)
- Medusa Ransomware Ransomware · 1 incident(s)
- Meow Ransomware · 1 incident(s)
- N0n Ransomware · 1 incident(s)
- NightSpire Ransomware · 1 incident(s)
Most targeted sectors
- Manufacturing 38 incident(s)
- Business & Professional Services 17 incident(s)
- Technology 13 incident(s)
- Government & Public Sector 7 incident(s)
- Healthcare 7 incident(s)
- Transportation & Logistics 7 incident(s)
- Hospitality & Tourism 6 incident(s)
- Retail & Consumer 5 incident(s)
- Construction 4 incident(s)
- Education & Research 4 incident(s)
- Energy & Utilities 3 incident(s)
- Financial Services 3 incident(s)
Recent claimed incidents
- Ahlqvist & Almqvist Arkitekter AB 2026-10-13 · Professional Services
- Vendus Sweden AB 2026-10-13 · Other
- Byrån för Arkitektur och Urbanism 2026-10-13 · Professional Services
- Mantum Holding AB 2026-10-13 · Other
- Brunnberg & Forshed Arkitektkontor 2026-10-13 · Professional Services
- Briab Group AB 2026-10-13
- Danvikshem (Stiftelsen Danviks Hospital) 2026-10-13 · Healthcare
- Englunds Konsultbyrå AB 2026-10-13 · Professional Services
- Spectrum Arkitekter AB 2026-10-13 · Professional Services
- Fab Support AB 2026-10-13 · Manufacturing
- Vadeto Group 2026-10-09
- Electro Heat Sweden AB 2026-10-02 · Energy & Utilities
- bakemyday.se 2026-09-28 · Retail & E-Commerce
- Electrolux 2... 2026-09-28 · Manufacturing
- Markisol 2026-09-26 · Manufacturing