Ricardo data breach: why "non-sensitive" contact data is a ready-made fraud kit

Updated 13 October 2026

• 890,000accounts affected
• 7 Octdetected
• 9 Octdisclosed
• 0passwords or emails exposed

Around 890,000 Ricardo accounts were affected by unauthorised access to names, postal addresses and phone numbers. The most reassuring line in the announcement, that no passwords or email addresses were exposed, deserves a careful reading. For a fraudster, knowing who you are, where you live, how to reach you and that you use Ricardo is often worth more than a password, because it is exactly what a convincing scam needs. The real governance lesson is therefore less about the technical perimeter and more about data mapping, minimisation and retention.

Ricardo data breach: what happened and what data was exposed?

Ricardo detected unauthorised access affecting about 890,000 accounts on 7 October 2026, and SMG Swiss Marketplace Group disclosed it on 9 October 2026.

1. 11 Apr 2024FDPIC investigation into Ricardo and TX Group concludedseparate case
2. 23 Oct 2024FDPIC final report publishedseparate case
3. 7 Oct 2026Suspicious server activity detected
4. 9 Oct 2026SMG discloses the breach; FDPIC notified
5. 13 Oct 2026This article updated

Ricardo says the vulnerability is fully closed and is informing affected users directly about possible consequences and precautions. SMG also told the AWP news agency that the data was never freely accessible.

Why are a name, an address and a phone number enough for fraud?

A name, an address and a phone number tied to a Ricardo account are enough to make a scam convincing. The fraudster knows the victim buys or sells on the platform and can reach them on the right channel.

1. 1Leakedname + address + phone
2. 2Context"uses Ricardo"
3. 3Messagepersonalised SMS, call or WhatsApp
4. 4Askpayment, code, IBAN change or link

Ricardo users were already being targeted before this incident, through fake buyers, fake Ricardo-branded emails and fraudulent WhatsApp messages. In June 2026, Bluewin reported the case of a Bernese family that lost more than CHF 40,000. In March 2026, SRF reported a rise of about 20% in reported Ricardo account takeovers since the start of the year, even though such cases remain in the per-mille range. A file that ties a name, an address and a phone number to an account on the platform gives these scams the context they were missing.

• CHF 40,000+lost by one Bernese familyBluewin, June 2026
• ~20%rise in reported Ricardo account takeovers since the start of 2026SRF, March 2026

Generative AI also changes the scale of the problem, because it makes a personalised, error-free message in the victim's own language quick to produce. Business sellers are especially exposed, since their company name and phone number open the door to fake supplier fraud, false invoices and requests to change bank details.

"Companies still file a name, an address and a phone number under low-risk data. Combined with the knowledge that someone sells on Ricardo, it becomes a ready-made fraud script, and generative AI now writes that script in flawless French or Swiss German in seconds."

Data minimisation: why keep order data at all?

Data minimisation means collecting and keeping only what a defined purpose requires. It is the most reliable protection against a breach, since data that has been deleted cannot be stolen.

On 11 April 2024, the FDPIC concluded an investigation into Ricardo and TX Group. Its final report, published on 23 October 2024, makes recommendations on the transparency of data transfers, on cross-platform tracking for targeted advertising and on valid consent. That report has nothing to do with the current incident, but it raises a question every organisation should be able to answer quickly: which data flows where, to whom, and for what purpose.

The FADP provides the tool to answer it. Article 12 requires a record of processing activities that describes, among other things, the categories of data, their recipients and, where possible, how long they are kept.

Companies with fewer than 250 employees are exempt from this record when they do not process sensitive data on a large scale or carry out high-risk profiling (art. 24 of the Data Protection Ordinance). Even so, the record remains the simplest way to know what you hold.

Order data illustrates the point well. It is essential to complete a transaction and handle a dispute, but far less useful years later, while its value to a fraudster barely declines.

"The question for every board on Monday is not whether they could be breached, but whether they know exactly where their customer data lives, who can reach it and why they are still keeping it, because data you no longer hold cannot leak."

FDPIC notification: what deadline applies, and what comes after the first 48 hours?

In Switzerland, a data security breach likely to result in a high risk to the personality or fundamental rights of the people concerned must be reported to the FDPIC as soon as possible (art. 24 FADP). Unlike the GDPR, there is no fixed 72-hour deadline. The controller must also inform the people concerned when their protection requires it or when the FDPIC asks (art. 24(4) FADP).

The FADP therefore does not fine the failure to notify itself. On the other hand, intentionally violating the minimum data security requirements (art. 8 FADP) can lead, on complaint, to fines of up to CHF 250,000 (art. 61 FADP), imposed on the responsible individuals.

How do you assess "high risk"?

Assessing high risk comes down to a few questions your team should be able to answer and document within hours.

4 of 5 criteria point to plausible harm; containment unknown → reporting is the prudent course

When several criteria point to plausible harm, reporting is the prudent course. In every case, the breach, its effects and the measures taken must be documented, including when you conclude there is no high risk. The documentation of a reported breach must be kept for at least two years from the date of notification (art. 15(4) of the Data Protection Ordinance).

Good incident communication states clearly what was and was not exposed, and explains to affected people what to expect. It also reminds them which channels the company will never use to contact them. That communication needs to last, because fraud that exploits leaked contact data can surface weeks later.

"Going from detection to public disclosure in two days is a respectable reflex, but what matters now is the next three months, because leaked contact data has long-term consequences and the fraud wave usually arrives weeks, or even months, after the headlines."

Is an SME affected when a third-party platform is breached?

A Ricardo breach also affects SMEs whose own systems are untouched, because their customers, staff and suppliers who are active on the platform become targets. For many businesses, Ricardo is a sales channel or simply where their customers shop. Most crisis plans, built around ransomware, do not cover that scenario. Third-party risk management exists precisely to show which platforms and processors hold data tied to your business.

"Resilience is also about the people downstream, so when a platform you depend on is breached, your customers and suppliers become targets and your incident management plan needs to cover events that happen elsewhere."

Is your data breach risk still rated correctly?

A data breach risk is rated correctly when its score reflects current evidence. That evidence includes the state of your controls, the open vulnerabilities on systems that hold personal data, and the third parties that can reach that data.

Ricardo says it has closed the vulnerability that allowed the access. That is a reminder that a customer database is usually exposed through a specific technical weakness on a specific system, long before anyone revisits the risk register.

"In many companies, the data breach risk is assessed once a year and then left alone, while the situation keeps changing: a new flaw appears on the server that holds customer data, a supplier is bought out, data that should have been deleted is still there. If the risk assessment is not updated when those facts change, you find out it was wrong on the day of the incident."

Ricardo data breach: seven actions for Swiss organisations this week

1. Map your exposure to Ricardo, whether through business accounts, staff who sell on behalf of the company, or customers and suppliers active on the platform.
2. Warn customers and teams about likely fraud, reminding them that you never ask for payments, codes or IBAN changes by phone, SMS or WhatsApp.
3. Require a call-back to a known number before any change of bank details or any urgent payment.
4. Update your record of processing activities (art. 12 FADP) for contact and order data, with purpose, access, recipients and retention period.
5. Set retention periods and delete or anonymise data that no longer serves a purpose.
6. Link open vulnerabilities to the systems that hold personal data, then review your data breach risk score against that evidence.
7. Test your notification procedure by defining who assesses high risk and within how many hours, who informs the FDPIC and the people concerned, and where the decision is documented.

See where your data travels, and whether your risk rating still holds

Every action Aiko takes follows your access profiles and is recorded in the Activity log, so you keep a full record of what was proposed and who confirmed it.

To see how the whole FADP programme runs in one place, read Swiss FADP compliance in Acuna GRC.

Request a demo

Sources

• SMG Swiss Marketplace Group, "Ricardo fixes security vulnerability affecting user data", press release of 9 October 2026 (EQS)
• Netzwoche, "Ricardo meldet Datenabfluss bei 890'000 Userkonten", 9 October 2026
• SRF, "«Keine Erpressung»: Ricardo meldet Datenleck bei 890'000 Konten", 9 October 2026
• blue News (Bluewin), "Personal data from 890,000 user accounts was exposed", 9 October 2026
• blue News (Bluewin), "Familie verliert 40'000 Franken" (Ricardo scam), 2 June 2026
• SRF Espresso, "Betrüger kapern vermehrt Ricardo-Konten", 26 March 2026
• FDPIC, final report on Ricardo and TX Group (23 October 2024)
• FDPIC, guide on reporting data security breaches and informing data subjects (art. 24 FADP)
• FDPIC, the FDPIC's role and the criminal provisions of the FADP
• NCSC (Federal Office for Cybersecurity), reporting obligation for cyberattacks: sanctions from 1 October 2025
• Fedlex, Federal Act on Data Protection (FADP, SR 235.1), arts. 8, 12, 24 and 61
• Fedlex, Data Protection Ordinance (SR 235.11), arts. 15 and 24
• Fedlex, Information Security Act (ISA, SR 128), arts. 74a to 74h (French text; no official English version)
• GDPR (Regulation (EU) 2016/679), arts. 33 and 83