Swiss online marketplace Ricardo has confirmed that unauthorised users accessed personal data from around 890,000 customer accounts. The company’s parent, SMG Swiss Marketplace Group, said it detected suspicious activity on its servers on October 7 and closed the security flaw within a few hours.
The exposed data includes names, postal addresses and phone numbers. For business accounts, company names were also affected. Ricardo says email addresses and passwords were not compromised.
Victims of the scam have taken to Reddit to express their frustration.
Scammers Are Already Using The Data
Reports published on Monday describe WhatsApp phishing messages sent from Swiss phone numbers. The messages use recipients’ real names, addresses, and phone numbers, then claim that “suspicious activity” was detected in a Ricardo transaction and ask recipients to click a link to confirm their account details.
The link does not lead to Ricardo’s official site. It directs users to a lookalike web address containing Ricardo’s name.
It cannot yet be proven that the personal details in these messages came directly from the Ricardo breach. But the timing and the use of accurate contact information make the connection plausible, and Ricardo itself has warned customers that the exposed data could be used for targeted fraud.
Read More: Swiss Home Prices Accelerate Despite Rising Mortgage Rates
Ricardo CEO Francesco Vass Contacted Affected Users Personally By Email On Friday Afternoon
He said the security gap was closed within a few hours of detection and that email addresses, passwords and other personal data were not affected.
Ricardo said it would file a criminal complaint with police and report the incident to the Federal Cybersecurity Office (BACS). It has also informed Switzerland’s Federal Data Protection and Information Commissioner (FDPIC/EDÖB).
Ricardo says it has observed no ransom demand.
The breach is significant because the stolen data is enough to make phishing messages highly credible. A scammer who knows a person’s name, address and phone number can impersonate a trusted company far more convincingly than with a generic message.
Ricardo says it never asks users to provide personal or sensitive information by email, SMS or WhatsApp, and does not communicate about purchases or sales through those channels.
Ricardo Data Breach: What To Do And What Not To Do
-
Do not click links in unexpected Ricardo-related emails, texts or WhatsApp messages.
-
Never enter your password, card details, Twint details or e-banking credentials after following a link from a message.
-
Go directly to ricardo.ch by typing the address into your browser if you need to check your account.
-
Do not trust the sender’s phone number. A Swiss number does not prove the message is genuine.
-
Check the official Ricardo app or website for transaction alerts rather than relying on a message.
-
Report suspicious messages to Ricardo and block the sender.
-
Be alert for follow-up scams by phone, letter or email in the coming weeks, as Ricardo has warned.
Ricardo has not said how the flaw was exploited, whether the perpetrator has been identified, or whether the data has been published or sold. It also has not confirmed that the WhatsApp messages are directly linked to the breach.
