Short answer
Ricardo, the Swiss online marketplace owned by SMG Swiss Marketplace Group, said it noticed suspicious activity on 7 October 2026 and that personal data from about 890,000 accounts was accessed. The company says email addresses and passwords were not affected and that no ransom demand has been made.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Ricardo |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Online marketplace |
| Country | Switzerland |
| Detected | 2026-10-07 |
| Disclosed | 2026-10-09 |
| People or records affected | About 890,000 user accounts |
What data was exposed
- Names
- Postal addresses
- Phone numbers
- Company names (business accounts)
What happened
Ricardo is one of Switzerland’s best-known online marketplaces. On 9 October 2026 it told users and the press that unauthorised people had reached personal data from about 890,000 accounts. According to SRF, the company noticed suspicious activity on its servers on 7 October.
The entry point was a security vulnerability. Ricardo has not described it in technical terms. It says the gap was closed straight away and is now fully fixed.
What Ricardo says it found
The company says the data was never publicly available and that it found no unauthorised access to personal data linked to individual orders. For business accounts, company names were also touched. Email addresses and passwords were not, according to Netzwoche.
Those statements come from Ricardo. No outside party has confirmed them, and the attackers have not said anything publicly.
How the company responded
Ricardo began technical measures as soon as it saw the activity. It has told the Federal Data Protection and Information Commissioner, and it plans a criminal complaint and a report to the Federal Office for Cybersecurity. It is emailing affected users with guidance.
Netzwoche links to coverage of a separate Swiss incident, the data leak at software supplier PK Softech affecting the federal pension fund Publica. No connection to the Ricardo incident has been reported. See our notes on the Publica supplier attack.
Why the data still matters
A name, a street address and a phone number are enough to make a scam message look real. Swiss users often see fake parcel notices and fake marketplace buyers. Our guides on phishing messages and online shopping scams show what those look like. The steps in what to do after a data breach apply here.
If you sell on Ricardo
Sellers should be careful with buyers who ask to move the conversation to WhatsApp or send a payment link. Real buyers use the platform’s own checkout. Ricardo’s notice does not change that rule, but your exposed phone number makes such approaches easier.
What is still unknown
Ricardo has not said who got in, how long the access lasted, or whether the data has been copied or offered for sale. The company says only that it found no ransom demand. All incidents we track are listed on our breaches page.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Fake parcel or delivery texts and WhatsApp messages that address you by name and postal address.
- Calls or messages posing as Ricardo support asking you to confirm card details or a Twint or e-banking login.
- Fake buyer or seller messages that use your real name and phone number to push you onto another payment channel.
What to do if you are affected
- 01Do not click links in unexpected SMS, WhatsApp or email messages that mention Ricardo, a parcel or a refund. Open ricardo.ch by typing the address yourself.
- 02Never give card details, Twint codes or e-banking logins to anyone who contacts you, even if they quote your name and address.
- 03Change your Ricardo password anyway if you reuse it on other sites, and turn on two-step login where it is offered.
- 04Report suspicious messages to the Federal Office for Cybersecurity (BACS) at report.ncsc.admin.ch and to your local police if you lost money.
- 05Watch your bank and card statements for several months and call your bank at once if you see a charge you do not recognise.
Frequently asked questions
Was my Ricardo password stolen?
Ricardo says passwords and email addresses were not affected. The company says the exposed fields were names, postal addresses and phone numbers.
How many Ricardo accounts were affected?
About 890,000 user accounts, according to Ricardo as reported by SRF and Netzwoche. The figure counts accounts, so it may not equal the number of distinct people.
Did the attackers demand a ransom?
Ricardo told reporters that no ransom or extortion demand had been made as of 9 October 2026. The attackers have not been identified.
Will Ricardo contact me if I was affected?
Yes. The company says it is writing directly to affected users with advice. If you hear nothing, treat any message about the incident with caution and check ricardo.ch yourself.
Who was told about the Ricardo breach?
Ricardo notified the Federal Data Protection and Information Commissioner (EDÖB) and plans to report to the Federal Office for Cybersecurity (BACS) and file a criminal complaint against unknown persons.
Sources
- Online-Marktplatz gehackt: Ricardo meldet Datenleck bei 890'000 Konten (Online marketplace hacked: Ricardo reports data leak at 890,000 accounts), SRF, 2026-10-09
- Ricardo meldet Datenabfluss bei 890'000 Userkonten (Ricardo reports data outflow at 890,000 user accounts), Netzwoche, 2026-10-09
- Ricardo meldet Datenleck bei 890'000 Konten (Ricardo reports data leak at 890,000 accounts), Südostschweiz, 2026-10-09
This post summarises public reporting as of 2026-10-30. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.