China suspected in cyberattack on Swiss space company

Beyond Gravity has become the focus of a suspected state-linked cyber operation. Switzerland’s state-owned space company reported a targeted attack earlier in October, describing the perpetrator as a presumably “highly professional actor”. Several people familiar with the matter have told Swiss public television SRF that company officials and the federal government internally suspect China was responsible.

The attribution remains unconfirmed. Beyond Gravity says the origin of the attack is still under investigation, while the Federal Department of Defense and the Federal Office for Cybersecurity are examining the incident. The company has also filed a criminal complaint against persons unknown with the Bern Public Prosecutor’s Office.

The case matters because Beyond Gravity sits inside a strategic industrial network. The company develops satellite and rocket technology, supplies the European Ariane programme and works with NASA. Its systems and expertise connect Swiss manufacturing to major international space projects.

The available information does not establish how the attackers entered the company’s systems or what they accessed. Swiss officials are now assessing the breach, its consequences and whether the case should trigger further action by federal authorities.

Swiss investigators have yet to publish evidence identifying the attacker. SRF’s reporting points to an internal assumption in Beyond Gravity and the federal administration that China was involved. The company and the Federal Department of Defense have declined to confirm that assessment publicly.

That caution reflects the difficulty of attributing cyberattacks. Investigators must establish how the intruders gained access, which infrastructure they controlled and whether the operation relied on tools or techniques associated with a known group. Technical clues can indicate links to a country, while still falling short of proof that a government ordered or conducted an operation.

Ralph Weber, a professor at the University of Basel’s European Institute who researches Chinese intelligence services, said he was not surprised by the suspicion. “China has its sights set on space,” he said, pointing to the sector’s importance to intelligence agencies and the intense strategic rivalry between China and the United States.

The Office of the Attorney General of Switzerland, which handles politically sensitive crimes including espionage, has not taken action in the case so far. The investigation remains with the authorities already examining the incident, while the public record contains no confirmed attribution.

The suspected breach appears to have involved stolen data. The precise material taken from Beyond Gravity has not been disclosed. Maya Graf, a Green Party parliamentarian and chair of the Senate’s Audit Committee, said the parliamentary Control Committees had been informed and that a report on the security incident had been submitted.

A relevant subcommittee will decide whether additional action is needed. That process gives lawmakers a route to examine the government’s response, the company’s safeguards and the possible exposure of sensitive commercial or technical information. It also allows parliament to assess whether the incident affected public interests beyond Beyond Gravity itself.

The company’s role makes the information question especially important. Beyond Gravity contributes components and technology to major space programmes, including Europe’s Ariane rockets and NASA missions. The source material does not say whether any customer systems were reached, whether classified information was involved or how much data was removed.

Those unknowns will shape the eventual damage assessment. Authorities will need to distinguish between ordinary corporate information, valuable engineering know-how and material with security implications. Until investigators release more findings, the scale and consequences of the breach cannot be measured reliably.

The incident revives a painful chapter in the history of Ruag International. More than 10 years ago, the wider Ruag group suffered a targeted and extensive cyberattack. Investigators later learned that spyware had seriously compromised IT security, with the details made public in 2016.

Experts at the time suspected Russia. The Office of the Attorney General opened criminal proceedings, then suspended them in 2018 because investigators could not identify the perpetrators. The attack carried consequences beyond the immediate loss of control over IT systems. The Swiss government eventually split the group, separating the business serving the Swiss Army into what is now Ruag MRO.

Several units of the remaining Ruag International were later sold. Beyond Gravity was the principal exception and remains part of the group’s space-focused structure. That history gives the latest incident a direct institutional context. It places a new attack against a company with an established record of handling strategically valuable technology.

The earlier case also illustrates the limits of prosecution in state-linked cybercrime. Even when investigators identify methods or probable affiliations, legal proceedings can stall without evidence that meets the required standard.

Switzerland’s space sector now faces a test of security, transparency and resilience. Beyond Gravity is a state-owned company operating in a field where commercial engineering and national strategic interests overlap. Its work for European and US space programmes means a breach can raise concerns well beyond the company’s own network.

For the federal government, the immediate priorities are to establish what happened, contain any continuing access and determine whether partners or regulators must be notified. The parliamentary Control Committees have already received a report, and their subcommittee will decide whether further scrutiny is required.

The China attribution will remain sensitive while the investigation continues. Publicly assigning responsibility carries diplomatic and legal consequences, especially when investigators have not disclosed the technical evidence. Switzerland’s authorities must therefore separate confirmed findings from intelligence assessments and media reports.

The case also places attention on the protection of specialised industrial knowledge. Satellite and rocket suppliers may hold information that is commercially valuable, operationally sensitive or useful to foreign space programmes. The available record does not yet show what the attackers obtained. That answer will determine whether this was a contained corporate breach or a wider security incident affecting Switzerland’s role in international space manufacturing.