Breaches and incidents
Ricardo (SMG Swiss Marketplace Group): security flaw exposed names, addresses and phone numbers of about 890,000 accounts
Parent SMG said Ricardo detected suspicious server activity on 7 Oct 2026.
- Disclosed
- Verification
- Confirmed by two or more outlets
What happened
- Parent SMG said Ricardo detected suspicious server activity on 7 Oct 2026; data of about 890,000 user accounts was exposed: names, postal addresses and phone numbers, plus company names for business accounts. Email addresses and passwords were not affected (Blick, Netzwoche).
- Root cause: a security vulnerability that enabled the access (no technical detail given).
- No attacker named.
- The vulnerability was fully closed, affected users informed directly, the EDOEB notified, and Ricardo plans a criminal complaint and a report to the national cybersecurity authority.