Breaches and incidents
Swiss Ice Hockey Federation (SIHF): MySIHF portal data stolen with one user’s credentials and offered for sale
Per watson (citing SDA), an unauthorized person used the login credentials of a MySIHF user between 17 and 19 Oct to pull personal data from the...
- Disclosed
- Verification
- Confirmed by two or more outlets
What happened
- Per watson (citing SDA), an unauthorized person used the login credentials of a MySIHF user between 17 and 19 Oct to pull personal data from the federation’s central administration and game-operations portal; the SIHF found on Monday 26 Oct that the data was offered for sale on an internet forum. Data includes names, dates of birth, postal and email addresses, phone numbers, profile pictures and club/team affiliations; passwords were not taken. No count of affected people was given.
- Root cause: misuse of a single portal user’s credentials (per SIHF); how those credentials were obtained was not disclosed.
- No attacker named.
- The misused account was blocked and the “Schwachstelle” fixed, the EDOEB was informed and the SIHF said it would file a criminal complaint; it warned affected people of phishing and said the data “lassen sich nicht zurueckholen”.