Inquiry finds NDB cyber incidents largely clarified but Kaspersky doubts remain

A final external inquiry has found that incidents at Switzerland’s Federal Intelligence Service were “sufficiently clarified”, but uncertainties remain over its former cooperation with Russian cybersecurity company Kaspersky, SRF reported.

The investigation was commissioned in summer 2025 by Defence Minister Martin Pfister after SRF reported that an NDB cyber unit had shared sensitive data with private cybersecurity companies, including Kaspersky.

The Federal Department of Defence, Civil Protection and Sport said the inquiry found no fundamentally new findings or reliable evidence of prohibited political intelligence activities beyond the allegations already known.

It also found no evidence of data deletions “on a large scale”, an allegation previously made against former NDB employees in connection with the Kaspersky case.

However, the Federal Prosecutor’s Office has been investigating for more than a year after a complaint by the supervisory authority. It is examining whether classified information was systematically shared with Kaspersky and may have reached Russian intelligence services.

The inquiry was conducted by the independent law firm Lenz & Staehelin. The VBS said recommendations from earlier internal and external reports on incidents believed to have occurred between 2015 and 2020 had been largely implemented.