r/Switzerland • u/iridescent_shadow • 1d ago

Data breach at quitt.ch

Just received an email from quitt.ch regarding a cyber attack where around 30k employee details have been compromised/put up for sale after a hacker gained access to their platform. The data leaked includes all personal details including AHV numbers, residence permits and other sensitive information such as IBANs etc.

Has anyone else received the same email or know how to proceed in such a case? Appreciate any advice.

Edit - editing to add that I never signed up with quitt, my former employer gave my details to them in order to process my monthly salary. (Without my prior consent)

40 Upvotes

95% Upvoted

23 comments sorted by

•

u/AutoModerator 1d ago

Hi! Don't forget to participate in our current event! Swiss Food Week! more information...

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

22

u/nextized 1d ago

Since were probably affected by so many data breaches this week, maybe it would be interesting if the companies could be sued.

Its obvious that companies that have very sensitive information such as AHV numbers should be especially concerned with security. I hate that they can just be this incompetent, then inform the users that they are “so sorry” that it happened and call the hackers extremely sophisticated when a simple permission check was not properly performed in their legacy API.

Whats even worse is that this is the legacy API so how long has this been undetected?

22

u/Swigor 1d ago

With modern ai capabilities i would expect to see much more of such stolen data. Sad reality.

-7

u/buenzlifisch 1d ago

This has nothing to do with AI, data breaches have been common long before AI. Of course Hackers utilize AI aswell, but it's not the reason these breaches keep happening.

20

u/blopsi 1d ago

AI made it way easier to automate finding exploits and weaknesses on a larger scale. They were already there before apart from simple things automatically scanning wasn't that useful

11

u/tzt1324 1d ago

I think he is talking about the increase of these incidents

3

u/wein_geist 23h ago

They didnt claim this is solely because of ai?? They just said it will increase because of it, which you kind a supported ('hackers utilize AI as well"), i.e an additional (very powerful) tool for them. So i dont really get your comment.

•

u/billcube Genève 15h ago

This can be either the attacker using AI with attack tools, but also the company having put to much trust in software or configuration made with AI tools. Vibe-coding your software or your infra is a huge risk.

4

u/Swigor 1d ago

Not always AI id involved. But more and more. Voice cloning, convincing emails (social engeneering). Hacks via reverse engeneering of software or finding security holes etc. This certainly will, and probably does already, increase such incidents.

4

u/swissthoemu 1d ago

And we’re not regulating anything. We’re so smart.

1

u/AutomaticAccount6832 1d ago

That they inform the affected people so fast now (also Ricardo) actually shows that the rules in place are scary enough for them to not try to hide it first.

What we need are mechanisms that protect our data. Leaks will always happen. So the real protection is to use some ID or hashes instead of clear data.

•

u/billcube Genève 15h ago

e-id is coming but later than expected. https://www.eid.admin.ch/en/e-id-e

•

u/AutomaticAccount6832 14h ago

I really hope that will help to protect our data…

4

u/justonesharkie 23h ago

i haven’t used quitt in over 3.5 years. it’s bullshit they still have my data

7

u/vouvoyer 23h ago

In the EU they likely would have had to purge your data after about 1 year.

•

u/naza-reddit 13h ago

Same here. Used it 5-6 years ago. Haven’t received any email from quitt. Have you?

•

u/justonesharkie 11h ago

yes i got an email 🤡

3

u/TheAmobea 22h ago

Expect more spam/phising calls or mails. You'll have to be more cautious about that in the future.

Not much more to do.

•

u/teodorrosca 16h ago

Received the same from Publica(LPP) yesterday, they say their « software services provider » was targeted. Wouldn’t be surprised if more CH services suffered the same, if they relied on the same provider.

•

u/leartcharmant 10h ago

Data breach at offerz.ch also

EDIT: Its getting out of hand they are targeting swiss companies stay cautios fellow SDE’s

•

u/Beneficial_Mulberry2 9h ago

Just got a letter from publica. My AHV no., telephone no., email, adress, salary, etc. leaked. And now what? Disgusting

•

u/StrandsOfIce Zürich 2h ago

Sad state of affairs

•

u/Glittering-Cycle4118 11h ago

I'm so glad eID, electronic patient record, etc. is comming out. Definitely nothing is going to happen there.