Swiss Basketball, the Swiss basketball federation, confirmed on 31 October 2026 a data theft affecting its licensed members, via its Basketplan platform. A user of a hacker forum claims to have exported an extranet belonging to the federation. According to the German-language Swiss site Inside IT, the French Breaches platform counted 52,344 entries in it, described as concerning employees: names, dates of birth, addresses. It is the second Swiss sports federation hit in a week.
What Swiss Basketball confirms
On 31 October 2026, the federation published an "information for Swiss Basketball licensed members" on its website. In it, it acknowledges "a security incident involving personal data of its licensed members via Basketplan".
The incident occurred despite additional measures, such as two-factor authentication, the statement specifies. The federation says it does not yet have all the information on the origin and extent of the incident.
It states that passwords, bank details and photos were not stolen. It is working with its IT service providers and the authorities to clarify the circumstances. The data theft was reported to the federal cybersecurity authority, the Federal Office for Cybersecurity (FOCS).
According to Inside IT, no concrete case of misuse of the data was known as of 2 November 2026.
What the hacker claims, according to French Breaches
The account of the attack comes from a hacker forum. A user there claims to have gained access to an extranet of the federation and to have exported its data. French Breaches, a platform that tracks data leaks, then analysed the published files, Inside IT reports.
Its count gives an idea of the contents:
- 52,344 entries described by Inside IT as concerning employees, with names, dates of birth, addresses, phone numbers and e-mail addresses;
- more than 6000 fields filled in with an AHV number (Swiss social security number) in the licensed members file;
- around 36,000 other entries linked to accounting and licence management;
- 21,648 entries whose date of birth corresponds to a person under 18.
This last figure calls for a caveat. French Breaches calculated it from the usable dates of birth. It does not necessarily correspond to as many different minors.
| Point | Claimed or analysed by third parties | Confirmed by Swiss Basketball |
|---|---|---|
| Access | Export of an extranet of the federation | Security incident via Basketplan |
| Volume | 52,344 entries, according to French Breaches | Extent still unknown |
| Data | Identity, contact details, AHV numbers | No passwords, bank details or photos |
| Minors | 21,648 entries under 18 | Not mentioned |
Our analysis: the federation's statement says what was not stolen. It says nothing about the dates of birth or the AHV numbers that French Breaches says it found.
After ice hockey, a second sports federation hit
Four days earlier, the Swiss Ice Hockey Federation (SIHF) had written to the people affected by the data leak from the MySIHF portal. According to Inside IT, 540,000 records and information on around 87,000 people were stolen from it.
The two cases are alike on one point. In both federations, the data concern members' identity and contact details, without passwords according to the federations. The SIHF, however, had reported the incident to the Federal Data Protection and Information Commissioner (FDPIC), according to the Keystone-ATS news agency cited by 2clics.
The pattern also recalls the TCS Camping case. After the data theft at TCS Camping, fraudsters wrote to customers on WhatsApp using real booking information.
What to do if you are a Swiss Basketball licensed member
The main risk is targeted phishing. The federation urges its licensed members to be wary of messages that ask for personal information or contain unusual links.
The FOCS describes three forms of these scams on its website:
- by e-mail, phishing leads to a fake website, often in the name of a well-known company: never click on the link;
- by phone, vishing pushes the victim to act in their "own interest", often with hidden or spoofed numbers: end the call;
- by text message, smishing can appear in the thread of a company's genuine messages, because the sender number is spoofed.
Our analysis: a fraudulent message may mention your name, your date of birth or your club. These details do not prove that it comes from the federation. A request for payment or data deserves to be checked with the club, using a known number.
Some of the entries reportedly concern minors. Parents of young licensed members would therefore do well to pass these guidelines on to them. A suspicious message can be reported to the FOCS, which receives voluntary reports from the public.
For clubs, the case is a reminder of the value of phishing awareness training for volunteers, and of a cyberattack response plan written in advance.
Data leaks in Switzerland: what the nFADP requires
The duty to report data security breaches is a new feature of the Federal Act on Data Protection (FADP, or nFADP), according to the FDPIC. It appears in its Article 24.
Art. 5 let. h of the Act defines a breach. A breach occurs, in particular, when personal data are disclosed or made accessible to unauthorised persons. Art. 24 sets two obligations for the controller:
- report the breach to the FDPIC when it is "likely to result in a high risk" for the data subjects (para. 1);
- inform the data subjects in the cases provided for in para. 4.
On 7 February 2025, the FDPIC published a guide clarifying these concepts. It also offers an online form, "DataBreach", for submitting reports.
Two federal reporting offices coexist. The FDPIC oversees personal data; the FOCS handles the incident from a technical angle. Since 1 April 2025, operators of critical infrastructure must report their cyber incidents to the FOCS; for an SME, such reporting remains voluntary.
Swiss Basketball's statement mentions the cybersecurity authority, but not the FDPIC. The Commissioner, Adrian Lobsiger, had counted 455 breach reports since the start of 2026, compared with 343 for the whole of 2025. On 23 October 2026, he opened an investigation into PK Softech, a supplier of pension fund software.
What we don't know yet
- Whether Swiss Basketball reported the incident to the FDPIC: its statement of 31 October 2026 does not say.
- The actual number of people affected, and the share of minors, which the federation has not quantified.
- The link between the extranet cited by the hacker and Basketplan, and how two-factor authentication was bypassed.
Sources
- Inside IT, "Datenleck bei Swiss Basketball", 2 November 2026
- Swiss Basketball, "Information destinée aux licenciés de Swiss Basketball", 31 October 2026
- Federal Office for Cybersecurity, "Hameçonnage (Phishing), Vishing, Smishing"
- FDPIC, "La nouvelle loi fédérale sur la protection des données du point de vue du PFPDT"
