Account takeover: Association and foundation, Switzerland 2026
In October 2026, an unauthorised person logged in to the administration and match operations portal «MySIHF» with a user’s login data and stole personal data: names, dates of birth, addresses, email, telephone numbers, profile pictures and club memberships, but no passwords.
- Incident · 10.2026 · Switzerland
- Evidence: confirmed by an authority
- Account takeover
- Data breach
As of
What happened
The federation discovered the data for sale in an internet forum. It blocked the access, closed the security gap, informed the FDPIC and warned those affected about phishing.
- Affected
- Swiss Ice Hockey Federation (SIHF)
- Industry
- Association and foundation
- Loss
- no reliable figure
- Business interruption
- unknown
- Ransom demanded / paid
- unknown / unknown
- Data affected
- Names, dates of birth, addresses, email, telephone, profile pictures, club membership; number not stated
- Bankruptcy
- no
- Entry point
- Login with a user’s login data on the «MySIHF» portal
What would cyber insurance have paid?
That depends on the terms. Whether those affected were insured: unknown.
-
Letters, call centre, credit monitoring
Mostly covered 6 of 9 business products cover it fully, as an add-on or with limits.
-
Third-party claims after a data breach
Liability for data protection and network security breaches
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
-
Loss of income because customers stay away after the incident
Mostly no information 1 of 9 business products cover it fully, as an add-on or with limits.
Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.
What we can learn
A single stolen password is enough if a portal with a lot of personal data does not require a second factor.
Sources
- Tor für Cyberkriminelle: Hacker klauen Daten des Schweizer Eishockeyverbands (opens in a new window) Netzwoche (gestützt auf SRF und Mitteilung des Verbands) · 28.10.2026
«könne der Verband ihre weitere Verbreitung nicht mehr verhindern»