Ricardo: data of 890'000 accounts exposed

Context

TL;DR

• A vulnerability exposed approximately 890'000 Ricardo accounts
• Names, postal addresses and telephone numbers made public
• E-mail addresses and passwords were not compromised
• IFPDT notified; police and UFCS will be informed

Key facts

• Platform → Ricardo
• Parent company → SMG Swiss Marketplace Group
• Detection → Wednesday, October 7
• Affected accounts → approximately 890'000
• Data exposed → names, postal addresses, telephone numbers
• Data not compromised → email addresses, passwords
• Vulnerability → fully resolved
• Authority notified → IFPDT

On Wednesday, October 7, the Swiss online marketplace Ricardo detected suspicious activity on its servers. It immediately initiated technical measures to secure the systems, according to the statement issued by its parent company, SMG Swiss Marketplace Group.

The subsequent investigation established that personal data from approximately 890'000 user accounts had been exposed. The information disclosed includes names, postal addresses and telephone numbers. The same statement specifies that email addresses and passwords were not compromised.

The sequence of the incident

The first step was the detection of suspicious activity; the second, technical intervention on the systems; the third, the subsequent investigation into access and personal data. Ricardo reports that the security vulnerability that enabled access has been fully resolved. The statement therefore describes a vulnerability linked to access and declared fully resolved after the suspicious activity.

For those who use the platform, the distinction between exposed data and uncompromised credentials is the central point of the communication. Names, postal addresses and telephone numbers are the information identified as having been made public; email addresses and passwords, on the other hand, remain excluded from the list of compromised data released by the company.

Ricardo is directly informing the affected users about the incident, its implications and the precautions they can take. In accordance with legal requirements, Ricardo informed the Federal Data Protection and Information Commissioner, the IFPDT. It also announced a criminal complaint to the police and a report to the Federal Office for Cyber Security, the OFCS.

The detection took place on the platform's servers, while the communication to users directly concerns the consequences for personal data. The timeline provided by the company brings these two aspects together without confusing access with credentials.

The parent company's communication therefore brings together the outcome of the technical investigation, the exposure of personal data and the initiatives launched by Ricardo. For the reader, the communicated picture is limited to these categories: affected accounts, personal data exposed, uncompromised credentials and initiatives launched by the company.

Operational details

For a Ricardo user, the practical issue is not merely that a breach occurred, but understanding which part of the profile falls within the reported exposure. The source clearly separates the data made public from access information: names, postal addresses and telephone numbers on the one hand; e-mail addresses and passwords on the other. This distinction makes it possible to assess the incident without attributing to it any data other than those indicated.

What to check in the communication

Ricardo is directly informing the affected users. The platform's message should therefore clarify three points: the incident, its implications, and the precautions that can be taken. These are the elements the company said it intends to communicate. For a user who receives the notice, the practical step is to compare the message with this structure, without replacing it with a standard list not present in the source.

On a technical level, the sequence described is precise: Ricardo detected suspicious activity, initiated measures to secure the systems and, with the subsequent investigation, established that the data had been exposed. The company also states that the vulnerability that enabled the access has been completely resolved. The technical fact communicated is therefore that the vulnerability was fixed; the practical interpretation must remain focused on this point.

The institutional scope should also be read without broadening it. The IFPDT was informed by the platform. The criminal complaint to the police and the report to the UFCS are instead initiatives that Ricardo announced. The source attributes these initiatives to Ricardo and presents them as announced steps, not as an outcome already achieved. The case concerns an online buying and selling platform; the website paths for conti bancari in Svizzera and calcolatore stipendio remain tools separate from the handling of this incident.

For those who receive the communication, the most concrete fact is the correspondence between the affected account, the categories of data exposed, and the precautions indicated. Everything else must remain anchored to the company's findings and announcements.

Recommended tools

For an updated estimate, use the net salary calculator and the CHF-EUR exchange comparator.

Key points

To remain faithful to the available information, the practical steps for an interested user are those announced by Ricardo. It is not correct to expand the list of data involved or add a procedure that was not described.

The steps indicated by the source

1. Read Ricardo's direct communication. The platform is contacting affected users and has stated that it will explain the incident, its implications, and the precautions that can be taken. 2. Compare the notice with the categories disclosed. The data indicated as exposed are names, postal addresses, and telephone numbers; email addresses and passwords are indicated as not compromised. 3. Follow the precautions contained in the individual communication. The source confirms that Ricardo is communicating the precautions that users can take. The operational instructions should therefore be read in the platform's message, without replacing them with measures that were not reported. 4. Separate the communication to users from the institutional follow-up. Ricardo notified the IFPDT of the incident and announced a criminal complaint to the police, in addition to reporting it to the UFCS. These steps are attributed to the platform.

Technically, the company states that it immediately initiated measures to secure the systems and reports that the vulnerability has been completely resolved. For the reader, this information describes the status of the technical fix; it does not expand the list of personal data indicated in the communication.

The documented sequence therefore remains limited to receiving the direct notice, reading its implications, checking the data categories, and applying the precautions indicated by Ricardo. There is no need to add steps that the cited communication does not attribute to users.

For the person receiving the notice, the sequence does not change based on the name of the entity involved: first comes Ricardo's communication, followed by reading its instructions. The notification to the IFPDT, the complaint to the police, and the report to the UFCS instead describe the path followed by the platform. The text thus keeps the direct relationship with the user separate from the obligations announced by the company.

For a separate in-depth look at the site's financial instruments, use calcolatore stipendio.

Source: swissinfo.ch