A supplier gets hacked, and your data goes with it
The 2023 attack on an IT supplier to the Swiss federal administration shows that risk does not stop at your own walls.
Published 16.10.2026
1.3 million
files published on the darknet
5,182
federal administration files with sensitive content, about half
4
objects containing readable passwords
What happened
In 2023 the group known as Play attacked Xplain, a major IT provider to federal and cantonal authorities, with ransomware. On 14 June 2023 the stolen data, presumed to be the whole package, was published on the darknet.
What the federal analysis found
The NCSC analysed about 1.3 million published files. About 65,000 were relevant to the federal administration, of which 9,040 belonged to it. Around half of those (5,182) contained sensitive content: 4,779 held personal data such as names, email addresses and phone numbers; 121 objects were classified and 4 contained readable passwords. The report does not assess why certain data was in the leaked set; that was left to an administrative investigation.
The lesson for a small company
Your suppliers and cloud services hold your data too. Knowing which ones, what they hold and what access they have is part of managing your own risk, and a readable password in a file is an access management problem. This case is public and involved a large organisation: it is an illustration, not a prediction.
That is why the Kadenz check includes suppliers and cloud services.
Sources
- Conseil fédéral / BACS · Xplain, Datenanalyse · 07.03.2024
We summarise; we do not reproduce. Sources consulted on 16.10.2026. These texts inform: they are not legal advice, and an average figure does not predict what will happen to a given company.