Data breach: Public administration, Switzerland 2026
In mid-August 2026, unknown persons used the eAutoIndex to retrieve vehicle keeper data from five cantons in an automated way, circumventing the query limits.
- Incident · 08.2026 · Cantons of Aargau, Lucerne, Schaffhausen, Vaud and Zug, Switzerland
- Evidence: confirmed by an authority
- Data breach
As of
What happened
The data affected is the number plate, name and address of vehicle keepers who have not blocked their data. The operator and the canton of Vaud received extortion attempts; the cantons filed criminal complaints and warned of fake payment demands for fines or toll charges.
- Affected
- eAutoIndex of the cantons of Aargau, Lucerne, Schaffhausen, Vaud and Zug
- Industry
- Public administration
- Loss
- no reliable figure
- Business interruption
- unknown
- Ransom demanded / paid
- yes / no
- Data affected
- Number plate, name and address of vehicle keepers in five cantons who had not blocked their data; number not stated
- Bankruptcy
- no
- Entry point
- automated queries via a technical interface, query limits circumvented
What would cyber insurance have paid?
That depends on the terms. Whether those affected were insured: unknown.
-
Help and negotiation; only some insurers pay the ransom, see note
Mostly add-on 6 of 9 business products cover it fully, as an add-on or with limits.
-
Letters, call centre, credit monitoring
Mostly covered 6 of 9 business products cover it fully, as an add-on or with limits.
-
Proceedings before authorities
Costs of FDPIC or GDPR proceedings, usually not fines
Mostly limited 6 of 9 business products cover it fully, as an add-on or with limits.
Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.
What we can learn
Even public data becomes a risk if it can be queried en masse; interfaces need a volume limit.
Sources
- Datenabfluss beim eAutoIndex (opens in a new window) Kanton Zug (gemeinsame Medienmitteilung der Kantone AG, LU, SH, VD, ZG) · 28.08.2026
«Gesperrte oder anderweitig geschützte Daten von Halterinnen und Halter waren nicht betroffen.»