Switzerland's SMG group announced on October 9 that its marketplace Ricardo detected suspicious server activity on October 7 and found personal data of about 890,000 user accounts was exposed; the vulnerability that allowed the access has been fixed [1]. Exposed data was limited to names, postal addresses and phone numbers plus company names for business users, with emails and passwords unaffected; the company notified the Swiss data protection commissioner and will file a police complaint [1][2]. Affected users should read the notice Ricardo sends them directly and follow its precautions against scams using this data [1].
Flaw in Swiss marketplace Ricardo exploited, exposing names, addresses and phone numbers of about 890,000 accounts
1 min read
- Disclosed
- Oct 9, 2026
- Occurred
- Oct 7, 2026
- Published
- Nov 11, 2026
- Last updated
- Nov 11, 2026
- Scale
- 890,000 accounts[1]
- CVSS basis
- Our assessment
- Technology
- Attack vector
- Impact
- Data type
- Actor type
- Motivation
On this page
30-second summary
What happened
Who is affected
Industries mainly affected: Retail
What to do nowOur advice
- Read the incident notice Ricardo sends you directly and follow its recommended precautions [1].
- Beware of scam contact using your name, address and phone number .
Timeline
Technical details
Remediation
Vendor guidance
- 1Watch for scam contact detect[1]
Follow Ricardo's notice and watch for scams.
References
Official / primary1
- [1]
“The ensuing investigation has since established that personal data relating to approximately 890 thousand user accounts was exposed.”
Media1
- [2]
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.