Free access to surnames and names: SBB announces the leak of approximately one million data

Also read:

This corresponds to 0.2% of all registrations, we can read in the press release from Alliance SwissPass and SBB on Monday. In the meantime, the man has “irreversibly” deleted the data he had downloaded.

Reported from outside

The leaked data contained information about purchased tickets and/or the validity period of subscriptions. About half of the data related exclusively to customers’ last names, first names, and dates of birth.

Information on place of residence, means of payment, passwords and email addresses was not provided. The other half of the data contained impersonal information about tickets purchased from vending machines.

In their statement, SBB and Alliance Swisspass apologize to customers. To explain this setback, we must go back to the end of 2020 when the CFF reinforced the security of the subscription renewal process through this platform.

federal warden

Since customers of several public transport companies could no longer easily renew their subscription, SBB restored access with the old mechanism in December 2021. This decision turned out to be unfortunate: it created a security loophole.

Due to the fact that the external expert notified SBB, the loophole was able to be closed, the statement said. From now on, no more data can be consulted without authorization.

SBB immediately informed the Federal Information and Data Protection Commissioner and the public transport companies concerned. An internal investigation has been launched.