What is cybersecurity? Counted in Swedish incidents

You log in to your bank with your phone. You pay in a shop with your card. You get a text message about a parcel you have not ordered. Cybersecurity is involved in all three cases, and in the third case you yourself are the security system.

The word is used for everything from state intelligence services to the password on your router. This article explains what the word means, counts how many incidents are reported in Sweden and to whom, and shows what causes them. The answer to the last question is not what most people expect.

What the word means: three things that must hold

Cybersecurity is the umbrella term for the work of protecting networks, information systems and their users against threats, and information security is the part of that work that deals with the information itself.^{1, 15} And information security has a definition that is surprisingly simple once it has been translated.

The US standards agency NIST defines information security as keeping information and information systems safe from unauthorised access, use, disclosure, disruption, modification or destruction, in order to achieve three properties: confidentiality, integrity and availability.^{5, 7, 8} The same three properties are the core of the definition in the ISO/IEC 27000 family of standards, where the vocabulary sat in the family's overview document until the summer of 2026.⁹

Take them one at a time, with everyday examples.

Confidentiality means that only the people allowed to read something can read it. Your doctor should be able to read your medical records, not your neighbour.

Integrity means that nobody has changed anything without permission. The amount on the invoice should be the amount the sender wrote, not a different one.

Availability means that the system works when it should. A health centre that cannot reach its patient records on a Monday morning has a security problem, even if nobody has stolen anything.

The last example matters, because it shows that cybersecurity is about more than attackers. A system that stops working because of a software bug is a security incident, just like a break-in.¹ It is one of the reasons the statistics below look the way they do.

How many incidents are reported in Sweden?

Sweden has had a duty to report for several years: government agencies and providers of essential services, for example in healthcare, drinking water and transport, must report serious IT incidents to an agency.¹ In 2025 the reports were received by the Swedish Civil Contingencies Agency, which changed its name at the turn of the year to the Swedish Civil Defence Agency, and the agency compiles them itself in an annual report.^{1, 10}

In 2025, 266 cyber incidents were reported, from 95 different organisations.¹ Of the reports, 122 came from government agencies and 144 from providers of essential and digital services.¹

Over four years the number of reports was fairly stable and then fell: 330 reports in 2022, 333 in 2023, 319 in 2024 and 266 in 2025.¹ Government agencies account for the whole fall: from 231 reports in 2022 to 122 in 2025.¹ Reports from providers rose from 99 in 2022 and have since stayed at about the same level: 144, 149 and 144.¹

Two things to know before you draw conclusions from the curve.

The first is that the reports come from a small share of all organisations. In 2025, 16% of the government agencies with a duty to report reported at least one incident, and among providers the agency estimates the share at 9%.¹ The agency points out that many incidents still go unreported.¹ So fewer reports do not necessarily mean fewer incidents.

The second is who reports. Of the reports from providers, 80% came from healthcare, 13% from the drinking water sector and 4% from the transport sector.¹ Healthcare is the sector that reports the most, which is not the same as being the most exposed.¹

Most reported incidents are not attacks

The causes behind the incidents

Here is the figure that tends to surprise people. Of all incidents reported in 2025, 9% were cyberattacks.¹ The year before, the share was 20%.¹

The rest had other causes. The most common causes given were unknown cause, followed by mistakes and system failures.¹ The agency's own analysis is that the unknown causes can usually be traced to system failures when you look more closely.¹

The agency sorts the causes into four groups: mistake, attack, system failure and natural event.¹ On top of these comes a fifth, unknown cause, which has gone from 12% of reports in 2022 to 32% in 2025.¹

The agency cannot say for sure what is behind the rise, but it points to the reporting rather than to the threats. It has read the free-text answers in the reports and found that the organisation often knows the cause, but the person filling in the form still ticks unknown.¹ A common case is software that does not start properly after a planned security update.¹ The fault can be pinpointed, but what triggered it cannot be established exactly, so the answer becomes unknown.

Among the causes that are given, changes made to the organisation's own IT systems account for the largest share of both the mistakes and the system failures.¹

The incident often comes from a supplier

Just over 44% of the reports in 2025 were about incidents that started at a supplier and then hit the organisation buying the service.¹ The year before, the share was 51%.¹

That fits the definition at the start. A system that stops working because an update went wrong can be an incident that must be reported, if it hits an organisation covered by the rules and reaches the agency's threshold. It happens more often than someone breaking in. The picture of cybersecurity we get from films, a person in a hood in front of a screen, describes barely a tenth of everything that is reported.¹

Personal data is counted somewhere else, and the figures must not be added together

There is a second count in Sweden, at the Swedish Authority for Privacy Protection. Organisations must notify it when personal data has gone astray, for example if a file with customer details has been sent to the wrong person or leaked in a break-in.^{2, 11}

In 2025 the Swedish Authority for Privacy Protection received 12,276 personal data breach notifications.^{2, 11} That is a rise of almost 90% on 2024, and the highest number since the General Data Protection Regulation took effect in 2018.² In total the authority registered about 28,300 cases during the year, against about 18,100 the year before, and complaints from individuals more than doubled.¹¹

The authority itself names one main reason for the volume. It is break-ins at organisations that have many other companies and agencies as customers.^{2, 11} When such a supplier is hit, each of its customers reports separately, and in the 2025 case data on a large part of Sweden's population was published on the dark web after an extortion attempt.^{2, 11}

Do not add 266 and 12,276 together. The two figures measure different things at different agencies, with different rules on who must report. The first is serious IT incidents at organisations with a duty to report. The second is events where personal data has been mishandled, with a much lower threshold. Breaches that are unlikely to pose a risk to people's rights do not have to be reported.¹¹ The same break-in can appear in both counts, once as an IT incident and many times as a personal data breach.¹

The fraud that hits you as a private person

Neither of the two counts above is about ordinary people. That count is kept by the Swedish National Council for Crime Prevention, which compiles all reported crimes.

Fraud in the reported crime figures

In 2025, 1,439,163 crimes were reported in Sweden, 3% fewer than in 2024.^{3, 12} Fraud went the other way and rose by 1%, to 232,862 reported offences.¹² That means 16% of all crimes reported in 2025 were fraud, worked out as 232,862 divided by 1,439,163.¹²

The type of fraud that rose most was card fraud without a physical card, that is, when someone uses your card details online without holding the card: up 8,867 offences, or 10%.¹² Advert fraud and card fraud with a physical card fell the most, by 3,207 and 3,025 reported offences respectively.¹²

How it looks to the people targeted

Seen from the other side, from the people targeted, it looks different. The Swedish Internet Foundation's survey Svenskarna och internet 2025 (Swedes and the internet 2025) gives some figures. Six in ten internet users aged 16 and over have seen a scam advert on social media in the past year.¹³ 3% say they have also been victims of advert fraud, and men of retirement age are the group hit most often, twice as often as the average.¹³ Only a third of those who have seen a scam advert have reported it to the platform, and older people are the least likely to report.¹³

Fraud also costs people who do not fall for it. A third of Swedes have held back from buying a product they were interested in, because they suspected it was shown in a scam advert.¹³ And the most common way to spot a scam advert is the oldest of all: the offer seems too good to be true.¹³

The survey is based on 3,362 respondents, most from a randomly recruited panel and the rest from extra telephone interviews, collected in January 2025 and weighted to match the population by sex, age, education and region, among other things.¹⁴ That is an unusually clear account of method, and it is why the figures are here.

The law that has just come into force

On 15 January 2026 the Cybersecurity Act came into force.^{15, 17} It is how Sweden puts the EU's NIS2 Directive into law, and it greatly widens the duty to report.^{15, 16} The agency estimates that 2,000 or more organisations are covered by the new law, against about 600 companies covered by the earlier legislation.¹

At the same time the job has moved. On 1 July 2026 the public-facing cyber remit moved to the National Cyber Security Centre, part of the National Defence Radio Establishment, which takes over collecting the reports that the annual report is based on.^{1, 17} The agency itself writes that the next annual report will be published by the new centre, with more organisations with a duty to report behind the figures.¹ Anyone comparing 2026 with 2025 needs to keep this in mind, because more reports in the next count could just as well mean more organisations reporting as more incidents.

What to take away

Cybersecurity means that only the right people can read, that nobody changes anything without permission and that the system works when it should. In 2025, 266 serious incidents were reported to the receiving agency, barely a tenth of them attacks, while personal data breaches are counted separately, 12,276 of them, and reported fraud offences numbered 232,862.^{1, 2, 12} The structure behind the figures is that the most common reported incident is dull: a system that stops working, a file that goes the wrong way. At the same time the requirements are widening. Since January 2026 a law has applied that, according to the agency's estimate, covers 2,000 or more organisations, against about 600 companies under the earlier legislation.¹ Follow three recurring publications: the annual report on cyber incidents, the Swedish Authority for Privacy Protection's February figures and the Council for Crime Prevention's final crime statistics in March.^{1, 2, 3}

The next episode is S1:E4 Semiconductors, about how a chip is made and what Moore's law really says.

Education, not advice.