A wave of cyberattacks in Switzerland: Publica, Ricardo, a hotel and record reports. What to do if your data is involved
Note. This article is based on official statements and news published up to 12 October 2026. Several investigations are still under way: some details may change. Where a piece of information has not been confirmed, I say so.
On Friday 9 October I too received Ricardo's email announcing that my data had been exposed (SMG Swiss Marketplace Group statement). The same day it emerged that the Federal Office for Cybersecurity had broken its weekly record for reports (tvsvizzera.it/Keystone-ATS, Ticinonline). The day before, news had broken of the data leak at the federal pension fund (RSI). A few days before that, a state-owned aerospace company had confirmed it had been hit by a targeted attack (swissinfo.ch).
Taken one by one, these are news stories. Lined up side by side, as you would in an investigation, they tell a more precise story: how Swiss organisations are being attacked today, and why the consequences reach ordinary people.
The file: the cases of September and October 2026
| Date of announcement | Organisation | What happened | What we know about the data |
|---|---|---|---|
| 6 September | Hotel Schweizerhof, Lenzerheide (GR) | Booking systems breached; about 10,000 recipients receive a security notice | Still unclear which data was stolen; guests are receiving scam WhatsApp messages (Ticinonline) |
| 8 September | CHUV, Lausanne | Cyber incident at an external laboratory specialising in cancer diagnosis, probably triggered by a scam phone call (vishing) to one of the supplier's employees; CHUV's own systems were not affected | Name, date of birth, health insurance details and name of the treating physician of 11 CHUV patients published on the dark web; according to the hospital, no health data (CHUV statement) |
| 3 October | Beyond Gravity | "Targeted attack" on its IT environment; first signs of malicious activity on 12 August | Not disclosed whether data was stolen (swissinfo.ch) |
| 8 October | Publica, federal pension fund | Attack on an external software supplier, discovered at the end of September; data leak | Number of people and type of data not yet known at the time of the announcement (RSI, tvsvizzera.it) |
| 9 October | Ricardo (SMG Swiss Marketplace Group) | A vulnerability allowed unauthorised access to personal data; suspicious activity detected on 7 October | Names, postal addresses and phone numbers of about 890,000 accounts; emails and passwords not affected, according to the company (SMG statement, bluewin.ch) |
| 9 October | Federal Office for Cybersecurity (FOCS) | Record 1,587 reports in one week | Mostly phishing attempts, scams and unsolicited messages (tvsvizzera.it/Keystone-ATS, Ticinonline) |
Added to these are some incidents from previous months:
- Stadler Rail (July 2026): using stolen credentials, attackers got into a data-exchange platform shared with a supplier. The Everest group demanded a ransom of 10 million francs; Stadler refused to pay, filed a criminal complaint and stated that its own systems were not involved and that no sensitive information was taken (RSI, Railway Gazette).
- Federal Office of Information Technology (August 2026): about 200 accounts compromised on the SharePoint servers run by the Office in federal data centres; passwords were reset and, at the time of the announcement, no data leak had been detected (FOITT statement).
- RUAG (June-August 2026): after an October 2025 ransomware attack on a US subsidiary of RUAG MRO, the company paid a ransom to the Akira group to recover the stolen data (RSI). On 4 August the Defence Department concluded that the payment was not unlawful, but criticised the assessment of political and reputational risks and the delay in informing the Confederation (RSI).
And some good news: on 30 September, an international operation involving the Federal Office of Police (fedpol) and the Office of the Attorney General led to three arrests and the seizure of five servers belonging to the KillSec ransomware group, which had among other things attacked several Swiss companies. At least 110 terabytes of stolen data were recovered (source: Swiss Federal Council release of 1 October 2026). Investigations do sometimes hit their target.
What they have in common: three recurring patterns
Pattern 1: getting in through the supplier's door
The most striking point in the file is this: in several cases the organisation affected was not breached directly.
| Organisation | Point of entry |
|---|---|
| Publica | An external software supplier |
| CHUV | An external laboratory, most likely attacked through a scam phone call to an employee |
| Stadler Rail | A data-exchange platform shared with a supplier, breached with stolen credentials; Stadler's own systems were not involved |
This is what specialists call a supply chain attack. A software or service supplier often works for dozens of clients and has access to their data, but rarely has the same defences as a large public body or a listed company. For an attacker it is the ideal weak point: one attack, many victims.
The investigator's lesson. In an asset investigation you don't just look at the main account, but at all the connected people and companies. The same principle applies to cybersecurity: your protection is only as strong as that of your weakest supplier.
Pattern 2: stolen data becomes targeted scams
The Lenzerheide hotel case is a textbook example. After the breach, guests began receiving WhatsApp messages asking for personal details and credit card numbers, using a 250-franc credit as bait. The hotel advised them not to reply and not to click any links (Ticinonline).
It is the pattern I described in the article on the Ricardo data breach: even seemingly harmless data, such as a name, address, phone number and the fact that you are a customer of a certain company, makes it possible to craft a personalised, credible message. The scammer no longer has to guess: they know who you are, where you live and who you do business with.
Pattern 3: long delays between attack and announcement
Beyond Gravity detected the first signs of malicious activity on 12 August and announced it publicly in early October. The company explained that, in cyber incidents, thoroughness comes before speed, and that an earlier announcement would have jeopardised the forensic analysis under way (swissinfo.ch).
It is a real dilemma, and one I know well from traditional investigations too: speaking too soon can alert the people you are looking for and ruin the evidence; speaking too late leaves people exposed without knowing it. There is no rule that fits every case, but there are legal obligations (see below) and a principle: when people's data is at risk, they must be able to protect themselves.
The record number of reports: how to read it correctly
On 9 October the Federal Office for Cybersecurity announced that it had received 1,587 voluntary reports in one week, the highest weekly figure since at least the start of 2025, beating the previous record of 1,353, set about a month earlier. Anyone wishing to check the week-by-week trend can consult the FOCS official statistics, updated every Tuesday (tvsvizzera.it/Keystone-ATS, Ticinonline).
A figure like this needs careful reading:
| What it means | What it does not mean |
|---|---|
| The pressure of scam and phishing attempts is very high | That there were 1,587 successful attacks |
| More people are recognising suspicious messages and reporting them | That Switzerland is "under attack" in a military sense |
| News of data breaches is prompting people to be careful | That every report corresponds to financial harm |
Most reports concern phishing attempts, scams and unsolicited messages. In other words: many people spotted the trick before falling for it. That is good news, but also a sign of how much the volume of attempts has grown. Several experts quoted in the press warn that artificial intelligence is making it ever easier to produce convincing messages, in any language and without mistakes (tvsvizzera.it/Keystone-ATS, Ticinonline).
What to do if your data is involved: a practical guide
In the first 24 hours
- Verify the notice through the official channel. If you receive an email or text announcing a breach, don't click the links: open the company's website or app yourself by typing the address, or call the number listed on the official website.
- Find out which data is involved. A name and address are not the same as passwords or card details. The right response depends on the data.
- If passwords are involved, change them immediately, on the affected service and on any other service where you reused them.
- If payment details are involved, contact your bank or card issuer immediately.
In the following weeks
| Risk | How it shows up | What to do |
|---|---|---|
| Targeted phishing | Emails or texts that mention the affected company, sometimes with your real data | Don't click; always verify through the official website |
| WhatsApp scams | Offers of "credits", "refunds" or "verifications" in exchange for card details | Don't reply; block and report |
| Fake phone calls | Someone claiming to be your bank, the police, technical support or the affected company | Hang up. Do not call back the number that called you, and don't use any number given during the call: look up the official number of the organisation they claimed to represent yourself, on its website or on a document you hold (bank card, statement, contract), and call that. Nobody has the right to ask you for login codes |
| Fake letters | Invoices or payment demands sent to your home address | Check with the company before paying |
| Identity theft | Accounts opened in your name, orders you didn't place | Check statements and notifications regularly; report anomalies immediately |
The basic defences, which always apply
- A different password for every service, kept in a password manager.
- Two-factor authentication on important accounts, preferring apps, security keys or passkeys to text messages.
- Distrust of urgency. Almost every scam rushes you: "within 24 hours", "final notice", "your account will be blocked".
I have collected these rules, step by step, in the guide on how to create a secure password and turn on two-factor authentication.
Your rights
- Right of access. The Federal Act on Data Protection (art. 25) allows you to ask a company which personal data it processes about you.
- Duty to notify. Those processing data must notify the Federal Data Protection and Information Commissioner of breaches likely to result in a high risk, and inform the people concerned when necessary to protect them (art. 24 FADP; see the FDPIC guide).
- Reporting and complaints. Scam attempts can be reported to the Federal Office for Cybersecurity through the form on its website. If you have suffered harm, it is a matter for the police: file a complaint and keep messages, numbers and receipts.
For companies and professional practices: five questions to ask today
| Question | Why it matters |
|---|---|
| Which suppliers have access to our data, and to which data? | Many attacks come through them. Without an inventory, you don't even know whom to alert |
| Do our supplier contracts include security obligations and immediate notification? | In an incident, every hour counts |
| Do we have multi-factor authentication on email, remote access and administration? | It is one of the most effective defences against the use of stolen credentials |
| Do we have a written incident plan? | Who decides, who communicates, who notifies the authorities, who informs customers. Improvising during a crisis is expensive |
| Can our staff recognise a targeted scam? | Most attacks begin with a well-written message and a person who trusts it |
Remember too that since 1 April 2025, operators of critical infrastructure (including authorities, energy, finance, health, telecommunications and transport) must report cyberattacks to the Federal Office for Cybersecurity within 24 hours of discovery, with fines possible since 1 October 2025; smaller organisations, with fewer than 50 employees and less than 10 million francs in turnover or balance sheet, are exempt (Swiss SME portal; FOCS, reporting obligation). Breaches of personal data with a high risk must also be notified to the Federal Data Protection and Information Commissioner.
Assessing how much information about your organisation and your staff is public, and how easily it could be used for a targeted attack, is one of the services I describe in the article on what an OSINT analyst does. For staff training on recognising scams, you will find the details among my services.
In short
| Question | Answer |
|---|---|
| What happened? | Within a few weeks: a data leak at Publica via a supplier, 890,000 Ricardo accounts exposed, a targeted attack on Beyond Gravity, guests of a Graubünden hotel targeted by scammers, and a record number of reports to the FOCS |
| What is the common pattern? | Access through suppliers, stolen data used for targeted scams, long delays between attack and announcement |
| Is the record number of reports an alarm? | It points to very high pressure, not 1,587 successful attacks |
| What should I do if I'm affected? | Verify through official channels, don't click, change reused passwords, turn on a second factor, distrust anyone asking for data or codes |
| And if I've suffered harm, for example by paying a scammer? | First call your bank or card issuer to block the card and, if possible, the payment: this is the most urgent step, because every hour counts. Straight afterwards, file a complaint with the police, bringing messages, numbers and receipts |
Cybersecurity now concerns more or less everyone, not just specialists. These cases show that even serious organisations can suffer an incident, often through a supplier. There is no reason to panic: in most cases a few habits, such as always checking through official channels, not being rushed, and using different passwords with a second factor, are enough to defeat the scam attempts that follow a data leak.
Main sources: RSI and tvsvizzera.it, on the Publica data leak and other federal incidents (8 October 2026); swissinfo.ch, on Beyond Gravity (3 October 2026); bluewin.ch and SMG Swiss Marketplace Group's statement, on Ricardo (9 October 2026); RSI and Railway Gazette, on Stadler Rail (21 July 2026); RSI, on RUAG (6 June and 4 August 2026); Federal Office of Information Technology statement on the SharePoint servers (4 August 2026); CHUV statement, on the incident at the external laboratory (8 September 2026); Ticinonline, on the Hotel Schweizerhof in Lenzerheide (6 September 2026); tvsvizzera.it (Keystone-ATS) and Ticinonline, on the record number of reports to the Federal Office for Cybersecurity (9 October 2026); Swiss government release on the operation against KillSec (1 October 2026); FOCS official statistics on voluntary reports; Federal Act on Data Protection; the Swiss Confederation's SME portal, on the obligation to report cyberattacks on critical infrastructure.
Frequently asked questions
What happened at Publica, the federal pension fund?
At the end of September 2026 an external software supplier to Publica suffered a cyberattack that led to a data leak. The supplier filed a criminal complaint and the Office of the Attorney General of Switzerland opened proceedings. At the time of the first statements, neither the number of people affected nor the type of data stolen was known; Publica has informed its insured members.
I have received a data breach notice: what should I do?
Check the notice only through the company's official channels, without clicking any links you received. Expect targeted scam attempts by email, text message, WhatsApp or phone. Change any reused passwords, turn on two-factor authentication, check your bank statements, and never give codes or payment details to anyone who contacts you.
Why do so many attacks hit suppliers rather than the main organisations?
Because a software or service supplier often has access to the data of many clients but weaker defences than a large organisation. Hitting a single supplier allows attackers to reach several victims with one attack. In the Publica, CHUV and Stadler Rail cases, access was gained precisely through an external supplier.
Where do I report a cyberattack or a scam attempt in Switzerland?
Scam attempts, suspicious messages and cyber incidents can be reported to the Federal Office for Cybersecurity through its online form. If you have suffered harm, for example a fraudulent payment, call your bank first to block the card and, if possible, the payment; then file a complaint with the police straight away.
Does the record number of reports mean more successful attacks?
Not necessarily. The 1,587 reports received by the Federal Office for Cybersecurity in one week mostly concern phishing attempts, scams and unsolicited messages, not successful attacks. The figure does, however, point to very high pressure and greater public awareness.
Are companies required to report a data breach?
The Federal Act on Data Protection requires those processing data to notify the Federal Data Protection and Information Commissioner of breaches likely to result in a high risk to the people concerned, and to inform those people when necessary to protect them. Since 1 April 2025, critical infrastructure operators must also report cyberattacks to the Federal Office for Cybersecurity within 24 hours of discovery.