For: users of Ricardo, the Swiss online marketplace (buyers, sellers and business users). This article is based on the official announcement by Ricardo's parent company, SMG Swiss Marketplace Group, and does not cover attack techniques.
Developing: this article will be updated as the organisation publishes more
- Who is affected
users of Ricardo, the Swiss online marketplace (buyers, sellers and business users).
- Confirmed so farSee the table ↓
- Names, postal addresses, phone numbers
- Company names (business users)
- Scale
3 more
- Date of detection
- Fix of the vulnerability
- Reporting to authorities
- Not yet confirmed
- Nature of the vulnerability
- Period of the unauthorised access
- Whether the exposed data has been published or misused
1 more
- How users who were not contacted can check
- What to do nowSee the steps ↓
- Do not answer requests for card details or bank or TWINT logins
- Do not open links; go to Ricardo through the app or a bookmark
- Handle unexpected letters without using the contact details in them
2 more
- Check Ricardo's direct notice through the app
- The announcement does not ask for a password change
- Where to verify (source)All sources ↓
- SMG Swiss Marketplace Group, "Ricardo fixes security vulnerability affecting user data" (October 9, 2026; also in German and French)
- Last checked
- As of October 31, 2026
Follow-up plans and what we checked
The October 9 announcement does not mention plans for a follow-up. As of October 31, no follow-up on this matter appears in SMG's list of media releases.
What Ricardo users should do today
Do not answer requests for card details or bank or TWINT logins
With names and phone numbers together, calls and texts claiming to be Ricardo support or a trading partner can sound genuine. Speaking to SRF, an SMG spokesperson urged particular caution with unexpected post, calls, and SMS or WhatsApp messages that ask for sensitive data such as credit card details or bank or TWINT (a Swiss mobile payment app) logins.
Do not answer anyone who asks for these, and hang up. A caller knowing your name or address does not prove who they are.
Do not open links; go to Ricardo through the app or a bookmark
Do not open links in messages posing as trade notifications or "receive your payment" requests. To check, open the Ricardo app yourself or go to the site from a bookmark (how to spot them: What is phishing?).
Handle unexpected letters without using the contact details in them
Postal addresses were exposed too. If an invoice or notice you do not recognise arrives, do not use the URL, QR code or phone number in it; check with the official contact you look up yourself. This is general advice; the company has not said such letters are being sent.
Check Ricardo's direct notice through the app
The company says it is informing affected users directly about the incident, its implications and the precautions they can take. If you are unsure whether a notice is genuine, check on the Ricardo screen you reach through the app or a bookmark, not through the notice's links.
The announcement does not ask for a password change
The company says email addresses and passwords were not affected. If you reuse the same password on other services, reviewing that is good practice in general, but it is not a step this incident requires (see: How password managers work and how to choose one).
What happened (from SMG Swiss Marketplace Group's announcement)
The following is based on the announcement SMG Swiss Marketplace Group published on October 9, 2026 (in English, German and French).
October 7, 2026
Ricardo detects suspicious activity on its servers and immediately starts technical measures to secure its systems.October 9
SMG announces unauthorised access to personal data linked to orders and that the vulnerability has been fixed. It says personal data relating to about 890,000 accounts was exposed, and that the FDPIC has been notified.As of October 31
No follow-up on this matter appears in SMG's list of media releases.
Exposed (about 890,000 accounts)
Name, postal address, phone number. Company name for business users
Not affected (company)
Email address and password. Payment data is not mentioned
The exposed items are phone and postal details, so watch calls, texts, messaging apps and letters in particular. Scam emails remain possible in general.
- What happened
- Unauthorised access to personal data linked to orders on the Ricardo platform
- Exposed data
- Names, postal addresses and telephone numbers; company names for business users. The company says the exposed data was limited to these
- Not affected (company)
- Email addresses and passwords
- Scale
- Approximately 890,000 user accounts
- Cause
- A security vulnerability that allowed the access; the company says it is fully resolved. Its nature has not been disclosed
- Notice to users
- Affected users are informed directly about the incident, its implications and the precautions they can take
- Reporting
- FDPIC notified. A criminal complaint with the police and a report to the National Cyber Security Centre (NCSC) are planned
What is known and what is not
The state as of October 31, 2026. When there is a follow-up, the status column will be updated.
| Item | What the announcement says | Status |
|---|---|---|
| Names, postal addresses, phone numbers | Exposed for about 890,000 accounts | Leak confirmed (company) |
| Company names (business users) | Exposed | Leak confirmed (company) |
| Email addresses | Not affected | Not included (company) |
| Passwords | Not affected | Not included (company) |
| Payment data (cards, bank accounts) | Not mentioned | Not stated |
| Scale | About 890,000 user accounts (not people) | Confirmed (company) |
| Date of detection | October 7, 2026 | Confirmed (company) |
| Fix of the vulnerability | Fully resolved | Confirmed (company) |
| Nature of the vulnerability, period of access | Not stated | Under investigation |
| Publication or misuse of the data | Not mentioned. SRF reported that an SMG spokesperson told the news agency AWP the data was never freely accessible and there had been no extortion or ransom demand so far | Not stated |
| Reporting to authorities | FDPIC notified; police and NCSC planned | Confirmed (company) |
How to read this: 'not stated' does not mean 'did not happen'
Payment data and misuse of the data are simply not mentioned in the announcement. Addresses and phone numbers have already been exposed, so act on the assumption that they can be used later in scam contacts.
What names, addresses and phone numbers can lead to
In general, combinations like these can be misused as follows. This does not mean it has happened here.
- Name + phone number: calls or texts posing as Ricardo support or a trading partner, using "receive your payment" or "verify your account" as a pretext to get card details or logins
- Name + postal address: letters posing as invoices or refund notices that lead to a fake site or phone number
- Company name + phone number (business users): calls posing as a trading partner or its staff, proposing a change of payment details
A past example: in the ENGIE customer data breach, where contact details and contract numbers leaked, the main warning was about calls posing as the company. This case may not follow the same course.
For operators: how long you keep contact data tied to orders
The cause has not been disclosed. This section does not assess Ricardo's response; it is a general check based on the items that were exposed.
- Decide how long you keep addresses and phone numbers tied to orders. According to the announcement, the exposed data was personal data linked to orders. Deciding when to delete, or show less of, the address and phone number of a completed order reduces what can be exposed in a breach.
- Tell users what you never ask for. A notice that states "we never ask for card details or logins by phone or message", sent together with the direct notice, makes fake contacts easier for users to spot.
Sources (public records)
The facts in this article are based on the public information below. Intrusion routes and methods that have not been disclosed are not speculated about.
- SMG Swiss Marketplace Group, "Ricardo fixes security vulnerability affecting user data" (October 9, 2026; also in German and French) — swissmarketplace.group
- The same, media release (PDF, October 9, 2026) — swissmarketplace.group
- SRF, "«Keine Erpressung» – Ricardo meldet Datenleck bei 890'000 Konten" (October 9, 2026, in German). Source for the SMG spokesperson's caution and the statement that there was no extortion or ransom demand — srf.ch
Update history
2026-10-31: First version. Based on SMG Swiss Marketplace Group's October 9 announcement and SRF's report. As of October 31, no follow-up on this matter appears in the company's list of media releases. This article will be updated when there is a follow-up.
Read next
- Same type of case: ENGIE customer data breach
- Spotting follow-on scams: What is phishing?
- Other 2026 incidents: Data breaches and cyberattacks of 2026 (Japan and worldwide)