Short answer
Offerz, a Swiss online shop for gift cards and vouchers, said attackers got into a test environment on the night of 7 October 2026 that held a file of January 2026 order data for about 115,000 customers. The company cannot confirm the data was copied but assumes it was, and says passwords and card data were not in the file.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Offerz |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Online retail (digital gift cards and vouchers) |
| Country | Switzerland |
| Detected | 2026-10-09 |
| Disclosed | 2026-10-14 |
| People or records affected | About 115,000 customers |
What data was exposed
- Order numbers
- Names
- Postal and email addresses
- Mobile phone numbers
- IP addresses
- Type of payment method used
What happened
Offerz sells digital gift cards and vouchers online from Switzerland. On 14 October 2026 it told customers that attackers had reached a test environment holding real customer data. Blick reported that the attackers got in on the night of 7 October and that Offerz found out on the morning of 9 October.
The test environment problem
The weak spot was not the live shop. According to IT Magazine, a file of order data from January 2026 had been created during technical work and left in cloud storage that both the shop and a test environment could reach. It should have been deleted once the work ended. It was not.
The test environment was watched less closely than production, which is why the access went unnoticed until the morning of 9 October. Offerz says an external IT provider runs its servers and programming, but that responsibility toward customers and authorities remains with the company.
How Offerz responded
The test environment was switched off on 9 October. Access rights and monitoring of test and development systems were adjusted. On 13 October it hired the security firm Infoguard for a forensic investigation, which is still running. Customers were emailed, and the company says personal data is no longer kept in test or development systems. Chief executive Dominik Megert apologised in the company’s statement.
What to watch for
Gift card shops attract a particular kind of fraud. A scammer who knows you bought vouchers can send a convincing “order problem” message. Read our guides on phishing messages and urgent payment scams before you respond to anything that mentions your order.
If you also use Ricardo, note that it reported a separate incident. Offerz says it has no confirmed link to that case or to the attack on a pension fund software supplier. See Ricardo for details, and what to do after a data breach for general steps.
What is still unknown
Offerz has not said who attacked it, and the forensic report is not finished. It is also unclear whether the stolen file, if it was stolen, has been offered anywhere. Browse other cases in our breaches section.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Fake messages that mention a gift card order, voucher code or refund, sent by email, SMS or WhatsApp.
- Calls or letters from someone posing as Offerz, a payment provider or your bank, using your real name and address.
- Requests to buy replacement gift cards and read out the codes. Gift card codes are a favourite payment method for scammers.
What to do if you are affected
- 01Reset your Offerz password when prompted. Change it elsewhere too if you reused it.
- 02Treat any message about a gift card order you did not expect as suspect. Do not click the link or call the number in it.
- 03Never read out or photograph gift card codes for someone who contacts you. No genuine company or authority asks for payment this way.
- 04Report phishing attempts to the Federal Office for Cybersecurity (BACS) and contact your local police if you paid.
- 05Check card and bank statements for charges you do not recognise and tell your bank if you find any.
Frequently asked questions
Were my card details stolen in the Offerz breach?
Offerz says card data, account data and passwords were not in the exposed file. A reader comment on IT Magazine claimed log files held passwords, but that is unverified and contradicts the company's account.
Was the data definitely taken?
Not confirmed. Offerz cannot show that data left its systems, but because of heavy traffic during the attack it assumes the data was taken as a precaution.
How did the attackers get in?
According to Offerz, they reached a test environment that could read a cloud storage folder. A copy of order data made during technical work had not been deleted afterwards. The company calls that an error.
Do I need to reset my password?
Yes, if Offerz asks you to. The company is requiring a password reset at next login as a precaution.
Which authorities were informed?
Offerz reported the incident to the Federal Data Protection and Information Commissioner (EDÖB) and the Federal Office for Cybersecurity (BACS), and announced a criminal complaint.
Sources
This post summarises public reporting as of 2026-10-30. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.