The Swiss Ice Hockey Federation (SIHF), Switzerland's ice hockey federation, has suffered a data leak on its MySIHF portal. Between 17 and 19 October 2026, an unauthorised person logged in with a user's credentials and viewed personal data. On 26 October, the federation discovered that this data was being offered for sale on an online forum. It fixed the vulnerability the same day, according to ICTjournal.

Swiss Ice Hockey: what happened on MySIHF

MySIHF is the federation's central portal for administering and organising matches, according to the specialist site Netzwoche. That is where the intruder got in, using an existing account. The SIHF gave the details in a message to potentially affected individuals, quoted by the Keystone-ATS news agency in a dispatch published by Plattform J on 27 October 2026.

DateWhat happened
17 to 19 October 2026An unauthorised person uses a user's credentials to access MySIHF data.
26 October 2026The SIHF discovers that information from MySIHF is for sale on a forum. It blocks the misused access and fixes the vulnerability.
27 October 2026The federation writes to potentially affected individuals.

Our calculation: seven days separate the end of the access, on 19 October, from its discovery, on 26 October. The discovery did not come from any known internal alert, but from the data being put up for sale.

The federation also informed the Federal Data Protection and Information Commissioner (FDPIC). It has announced its intention to file a criminal complaint, according to Keystone-ATS.

Which personal data is affected?

According to the SIHF's message, the stolen data may include:

  • names and dates of birth;
  • postal addresses and email addresses;
  • phone numbers;
  • profile photos;
  • club and team memberships.

Passwords are not part of the haul, the federation says. It stresses, however, that the data is now circulating on the internet and can no longer be recovered.

Our analysis: this haul contains neither banking data nor passwords. But for any one person, it brings together their identity, their contact details and their club. That is exactly the raw material for a credible fraudulent message.

What data protection law requires

The Federal Act on Data Protection (FADP, often called the revFADP since its revision) defines a data security breach in Art. 5 let. h. There is a breach, in particular, when personal data is disclosed or made accessible to unauthorised persons. The case described by the SIHF matches this definition.

Art. 24 FADP then sets two obligations for the controller:

  • report the breach to the FDPIC when it is "likely to result in a high risk" to the data subjects (Art. 24 para. 1);
  • inform the data subjects in the cases provided for by Art. 24 para. 4.

On 7 February 2025, the FDPIC published a guide clarifying these two notions. It also provides an online form, "DataBreach", for submitting reports securely. The SIHF took both routes: it informed the Commissioner and wrote to the potentially affected individuals.

Such reports are multiplying. Commissioner Adrian Lobsiger has received 455 breach reports since the start of 2026, compared with 343 for the whole of 2025. He has also opened a formal investigation into the service provider PK Softech, after the attack that hit the Zurich pension fund. In his view, the weak point is rarely the technology: in the vast majority of cases, it is human error.

Our analysis: access to MySIHF went through a user's credentials, which is in line with this finding. The federation does, however, also mention a security vulnerability, which it fixed without describing it publicly.

What should affected individuals do?

The SIHF warns against phishing attempts by email, text message or phone. This is the main risk it cites.

Our analysis: a fraudulent message may quote your name, your date of birth, your club or your team. These details therefore no longer prove that it comes from the federation or the club. An unusual request received through these channels deserves to be checked by another means, for example by calling the club on a known number.

Clubs, for their part, manage accounts on the portal. A single hijacked account was enough to open access to the data. They can use the incident to remind their volunteers of the basics of phishing awareness.

What we don't know yet

  • The number of people affected: the SIHF's message reported in the press does not give a figure, nor a breakdown between players, coaches, referees and club officials.
  • How the user's credentials were obtained, and the nature of the vulnerability fixed on 26 October 2026.
  • What happens next: whether the announced criminal complaint is actually filed, and how the FDPIC responds.

Sources