Ricardo Breach: 890K Accounts, Names and Phones Exposed

Sun Oct 11

Ricardo, Switzerland’s largest consumer-to-consumer online marketplace and a brand of SMG Swiss Marketplace Group, confirmed on 9 October 2026 that attackers gained unauthorised access to personal data linked to orders on its platform. Ricardo detected suspicious activity on its servers on 7 October 2026, locked down systems, and says the underlying security vulnerability has been fully resolved. An investigation established that data tied to roughly 890 thousand user accounts was exposed — limited to names, postal addresses, and telephone numbers, plus company names for business users. Email addresses and passwords were not affected, according to SMG’s media release. Ricardo is notifying affected users directly, has informed Switzerland’s Federal Data Protection and Information Commissioner (FDPIC), plans a criminal complaint with police, and will report the incident to the Swiss National Cyber Security Centre (NCSC).

This is a verified Ricardo data breach under the company’s own October 2026 disclosure — not a leak-site listing or an unconfirmed forum dump. The scale matters in a country of about nine million people: nearly a million marketplace accounts with real-world contact details is a large slice of Swiss online commerce. Canonical BreachHistory record: https://breachhistory.com/ricardo/ricardo2026 (/ricardo/ricardo2026).

What SMG has not published in the primary notice is as important as what it has: no attacker name, no ransomware demand, no description of the software flaw class, and no statement that payment or bank data left Ricardo’s order stack. Readers should treat anything beyond the field list and order linkage as unknown until prosecutors, NCSC, or Ricardo add detail.

Who Ricardo and SMG are — and why order-linked PII hurts

Ricardo.ch is the household name for second-hand sales, auctions, and fixed-price listings in Switzerland. Millions of Swiss residents have bought electronics, furniture, collectibles, or vehicles through the site; professional dealers and small businesses also maintain seller profiles. SMG Swiss Marketplace Group is the listed parent that operates Ricardo alongside other classified and marketplace properties in Switzerland and abroad.

Marketplace breaches rarely look like classic “password database” incidents. Buyers and sellers exchange shipping labels, pickup arrangements, and phone calls. That workflow pushes names, street addresses, and mobile numbers into order records even when login credentials stay hashed and segregated. An attacker who reads order-linked personal data gets material for phishing by post, smishing, and impersonation (“I’m the buyer for your Ricardo listing — send the item to this address”) without needing the victim’s Ricardo password.

Business sellers face an extra field: company names tied to commercial accounts. That helps fraudsters target sole proprietorships and small firms with fake supplier invoices or “marketplace compliance” scams that sound plausible because they reference a real trading name.

Swiss press including Neue Zürcher Zeitung and the Tages-Anzeiger framed the incident as a hack against a national online trading platform, emphasizing that email and passwords were not part of the exposed set — a distinction consumers often miss when headline writers say “890’000 Konten gehackt.”

What happened in the Ricardo breach 2026

According to SMG’s media release (9 October 2026) and the accompanying PDF:

Ricardo identified unauthorised access to personal data linked to orders on the platform.
Staff detected suspicious activity on servers on 7 October 2026 and started immediate technical measures to secure systems.
The security vulnerability that enabled the access was promptly fixed and is described as fully resolved.
Investigation results: personal data relating to approximately 890 thousand user accounts was exposed.
Exposed categories: names, postal addresses, telephone numbers; for business users, company names.
Email addresses and passwords were not exposed and were not affected.
Ricardo is informing affected users directly about the incident, implications, and precautions.
Ricardo notified FDPIC (German: EDÖB) as required by Swiss law.
Ricardo will file a criminal complaint with police and report the incident to NCSC.

Swiss German-language coverage on 9 October 2026 aligned with those facts: NZZ reported Ricardo discovered suspicious server activity on 7 October and closed the security gap; Tages-Anzeiger quoted SMG on full remediation of the flaw and direct user notification. Neither outlet, in the passages BreachHistory reviewed, added a confirmed intrusion vector beyond “Sicherheitslücke” / security vulnerability.

Timeline

7 October 2026 — Ricardo detects suspicious activity on its servers; immediate technical securing of systems begins; work starts to close the vulnerability.
7–8 October 2026 — Investigation continues; vulnerability fully resolved (per SMG wording).
9 October 2026 — SMG publishes media release “Ricardo fixes security vulnerability affecting user data”; Swiss newsrooms including NZZ and Tages-Anzeiger publish; scale (~890’000 accounts) and data-type inventory become public.
9 October 2026 and ongoing — Direct notifications to affected users; FDPIC notification; planned criminal complaint and NCSC report; user-facing precaution guidance in Ricardo communications.

What remains unknown publicly

Technical root cause — API misconfiguration, injection, broken access control, stolen admin credential, or third-party component flaw: SMG’s release does not classify the bug.
Attacker identity or motivation — no group name, no extortion note in the primary sources.
Whether data was exfiltrated to criminal forums — not stated in the SMG notice; absence of email/password exposure reduces credential-stuffing risk against Ricardo logins but not resale of contact lists.
Exact overlap with active buyers vs. dormant accounts — “890 thousand user accounts” is an account census, not necessarily 890’000 people (some users hold one account used rarely).
Cross-border data subjects — Ricardo serves Swiss users; whether non-Swiss residents appear in the order-linked set has not been broken out publicly.
Duration of unauthorised access — detection date is 7 October; dwell time before that window is undisclosed.

What data was exposed — and what was not

Confirmed exposed (company-attested)

Names associated with affected user accounts in the order context.
Postal addresses — shipping and billing style location data tied to transactions.
Telephone numbers — voice/SMS contact points buyers and sellers use to coordinate handoffs.
Company names for business users operating commercial seller accounts.

SMG explicitly ties exposure to personal data linked to orders. That framing suggests the incident channel is transactional records rather than, say, a full export of Ricardo’s marketing newsletter database or a dump of private messages — but the company has not published a table-by-table forensic map. If you received a Ricardo notice, treat the listed fields as authoritative for your account until Ricardo narrows or expands the description.

Confirmed not exposed (company-attested)

Email addresses
Passwords

That combination is unusually consumer-friendly as breach disclosures go. It means classic credential stuffing against Ricardo using this specific dataset should not work — attackers did not get login emails and hashes from this event per SMG. It does not mean your Ricardo account is invulnerable: unrelated leaks, malware on your device, or weak passwords reused from other sites can still compromise any marketplace account. It also does not mean scammers will skip Ricardo-themed lures; they can still guess or buy emails elsewhere and pair them with names and phone numbers from this breach for sharper social engineering.

Not mentioned in the primary notice

SMG’s release does not confirm exposure or non-exposure of:

Payment card numbers or bank account details
Swiss AHV/AVS national identifiers
Government ID images
Private chat message bodies beyond what might be inferable from order metadata
Ratings text, watchlists, or saved searches

Absence from a short media release is not proof those categories are safe — it means they were not part of the public inventory on 9 October. Payment flows on major marketplaces often tokenize cards through payment service providers; whether any payment metadata leaked would require a separate statement from Ricardo or regulators.

How the attack may have worked — within published bounds

Without a CVE, patch note, or post-mortem, technical writers must stay disciplined. SMG describes a security vulnerability that allowed unauthorised access, detected via suspicious server activity, then fully resolved. That pattern fits several classes of marketplace incidents seen elsewhere in 2024–2026:

Broken object-level authorization — an API endpoint that accepts an order ID and returns another user’s shipping block because the backend skips an ownership check.
Mass assignment or parameter tampering — a mobile or web client field that lets a caller escalate from “view my order” to “list many orders.”
Legacy integration paths — an older microservice still reachable from the internet that reads order tables for logistics partners.
Compromised operational access — stolen internal credentials used to query reporting databases (less common in a “vulnerability fixed” narrative but not impossible).

These are illustrative industry patterns, not Ricardo-specific findings. The important attested fact is order-linked personal data left Ricardo’s control through a software flaw that is now patched, not through a published password table breach.

Detection on 7 October 2026 implies Ricardo had monitoring or logging sufficient to flag anomalous server behavior — a positive signal for Swiss e-commerce operators reviewing their own SOC playbooks. The two-day gap to public disclosure on 9 October is consistent with initial containment, scoping, legal review, and regulator notification under Switzerland’s revised Federal Act on Data Protection (nFADP), which has sharpened documentation and notification expectations for significant personal-data incidents.

Who is at risk — by audience

Private buyers and sellers

If your account is among the roughly 890’000 affected, assume criminals can tie your real name to your home or pickup address and phone number. Risks include:

Delivery interception scams — messages claiming a Ricardo parcel needs re-routing fees.
Fake buyer outreach — “I paid already, here is my courier” schemes referencing your listing history tone.
Voice phishing — callers impersonating Ricardo support or Swiss Post using accurate address fragments to sound legitimate.
Physical security — for high-value traders who publicly sold expensive goods, exposed addresses can inform targeting (keep operational security in mind for future high-end sales).

Business and commercial sellers

Exposure of company names alongside personal contact data helps attackers craft B2B fraud: fake VAT compliance letters, counterfeit “Ricardo invoice” PDFs, or requests to “verify” bank details for marketplace payouts. Finance teams should brief staff that Ricardo confirmed order-linked leaks but not email — so incoming mail that uses your corporate name may still be fraudulent if it arrives through unrelated channels.

People who did not receive a notice

SMG says Ricardo is contacting affected users directly. If you have not heard from Ricardo by mid-October 2026, you may be outside the scoped account set — but marketplace users who changed phone numbers or moved without updating Ricardo profiles should not treat silence as proof of safety until Ricardo publishes clearer lookup tools or FDPIC materials appear.

Household members and roommates

Postal addresses may expose shared households. Family members who never opened a Ricardo account can still receive misdirected scam post or calls if the exposed address is current.

Swiss regulatory and law-enforcement posture

Ricardo’s statement names three Swiss institutions:

FDPIC / EDÖB — the federal data-protection authority notified under legal requirements. The commissioner’s office may later publish guidance or enforcement steps depending on severity and Ricardo’s cooperation; as of the 9 October release, the notification itself is confirmed, not the outcome.
Police criminal complaint — SMG says Ricardo will file one. Swiss cantonal and federal cybercrime units often coordinate on marketplace intrusions where data is sold or used domestically.
NCSC — Switzerland’s National Cyber Security Centre receives situational reports to warn critical sectors and correlate campaigns. Marketplace consumer data may feed broader alerting if the same vulnerability pattern hits other SMG properties (no such spillover is alleged in the primary release).

Under the nFADP framework in force since 2023, controllers must document incidents, assess risk to data subjects, and notify the FDPIC when processing is likely to result in a high risk to personality or fundamental rights. A sub-million account contact-data leak plausibly triggers that bar even without financial credentials.

Industry and campaign context — marketplaces in 2026

Consumer marketplaces remain high-value targets because they aggregate verified shipping identities. Incidents in other countries during 2025–2026 often combined API flaws with automated scraping at scale. Ricardo’s case differs from ransomware-led outages: SMG emphasizes fixing a vulnerability and data exposure, not encrypted production servers or public extortion timers.

For Swiss readers comparing headlines, the Ricardo breach 2026 sits in the same news cycle as other domestic digital-economy stress tests — supplier-side pension leaks, municipal ransomware, and classifieds fraud — but the attested data types here are narrower than full credential dumps. Security teams at other SMG brands will likely audit shared components, SSO patterns, and order APIs regardless of whether SMG says the flaw was Ricardo-specific.

Internationally, users searching was I affected Ricardo or Ricardo breach 2026 should rely on Ricardo’s direct email or in-app message, not third-party “check your email” sites that harvest addresses.

What Ricardo and SMG said about user precautions

The media release states Ricardo is informing users about the incident, its implications, and precautions they can take, without embedding the full precaution list in the English PDF text BreachHistory indexed. Until Ricardo publishes a FAQ URL, prudent defaults for Swiss marketplace users include:

Treat unexpected SMS or calls about Ricardo transactions as untrusted until verified inside the official app or website logged in via a bookmark — not via links in messages.
Do not share one-time codes, QR payment slips, or ID photos with “buyers” or “support agents” who initiated contact.
Update Ricardo profile contact details if you moved or changed numbers — future notices and legitimate buyer coordination depend on accurate records.
Enable strong authentication on Ricardo if the platform offers app-based or hardware second factors beyond passwords — passwords were not leaked here, but account takeover remains a standing risk.

When Ricardo’s user-facing precaution text becomes public, align action items with that document; SMG’s release explicitly promises users will receive guidance tailored to the incident.

What you should do — numbered action items

Read any Ricardo direct notification carefully. Note whether it cites order dates or account handles so you understand why your account qualified.
Do not panic-reset your Ricardo password solely because of this headline if SMG’s attestation holds for your account — emails and passwords were not exposed in this incident. Still rotate if you reuse that password elsewhere or if you prefer defense in depth.
Watch for phishing using your name, address, or phone number — in German, French, and Italian, matching Switzerland’s linguistic regions.
Verify high-value sales and purchases through in-platform messaging where possible; avoid switching to unverified WhatsApp or Telegram threads with strangers.
Business sellers: alert accounts payable and receivable staff that invoices referencing Ricardo or your company name may be fraudulent.
Consider Swiss Post / carrier scams — “customs fee” or “failed delivery” texts are common after address leaks; pay only through official carrier sites you navigate to yourself.
Document suspicious contact — save messages and report to local police cyber units if money or goods are lost; Ricardo’s planned criminal complaint supports broader investigations but does not replace individual reports.
Monitor FDPIC and NCSC publications for any supplemental guidance directed at marketplace users.
If you sell high-value goods, review pickup and meeting safety practices; exposed addresses may correlate with items you shipped in the past.
Stay skeptical of breach-checker spam — attackers know Ricardo is in the news; fake “verify your account” portals spike after verified disclosures.

Comparison to credential-heavy marketplace breaches

Many historic marketplace incidents — including large international classifieds — exposed email plus password hashes, enabling offline cracking and cross-site reuse attacks. Ricardo’s 2026 disclosure draws a bright line: contact and identity fields from orders out; authentication factors untouched according to SMG.

That shifts defender priority from mandatory mass password resets toward anti-fraud, customer education, and law-enforcement intelligence on who scraped the data. It also means Have I Been Pwned-style email lookup may not light up for this event if emails truly stayed out of the stolen set — users should not interpret a clean HIBP result as proof they were unaffected if Ricardo later emails them directly.

Technical defenders — lessons without overclaiming

Security engineers reading about the Ricardo data breach for their own e-commerce stacks should ask internal questions SMG’s public text implies but does not answer:

Which services can read order PII, and do they enforce per-user authorization on every query?
Did suspicious server activity mean outbound volume spikes, unusual database queries, or new admin sessions?
How quickly can you patch and attest “fully resolved” — and do you regression-test partner APIs that touch the same tables?
Are business-user company names stored in the same projection as consumer shipping rows, widening blast radius for B2B metadata?

Share these as review prompts, not as Ricardo post-mortem conclusions.

Media coverage — NZZ, Tages-Anzeiger, and primary sources

Swiss quality press treated SMG’s Friday disclosure as a national consumer story. NZZ’s headline emphasized hackers obtaining data from 890’000 Ricardo user accounts while repeating the company line that email and passwords were not compromised. Tages-Anzeiger stressed that Ricardo initiated security measures, fully closed the flaw, and would notify EDÖB while filing criminal charges.

Those articles are useful for German-language readers seeking local context; the authoritative field list and regulatory actions remain the SMG media release and PDF. BreachHistory does not treat tabloid speculation about attacker nationality or dark-web pricing as verified fact unless corroborated by Ricardo or Swiss authorities.

Canonical record and sources

BreachHistory indexes this as a verified Ricardo incident based on SMG Swiss Marketplace Group’s 9 October 2026 media release. Scale (~890 thousand user accounts), detection date (7 October 2026), exposed data types (names, postal addresses, telephone numbers, company names for business users), and exclusions (emails and passwords not affected) are company-confirmed.

Primary and reputable sources for this draft:

If Ricardo publishes a technical root-cause summary, a data-subject self-service portal, or an revised account count, update the catalog row and the timeline section here — do not retroactively imply email exposure or password resets unless the company changes its attestation.