Swiss banks UBS and Pictet disclosed on Wednesday that they were affected by a data leak caused by a cyber attack on their Swiss-based service provider, Chain IQ. Despite the breach, neither bank reported any compromise of client information.
According to Swiss newspaper Le Temps, tens of thousands of UBS employees’ data, including contact details and a direct internal line to UBS CEO Sergio Ermotti, were stolen. Chain IQ, headquartered in Baar, provides services to major firms including KPMG and Mizuho.
UBS confirmed that the incident involved stolen information related to the bank and other companies, emphasizing that no client data was affected. The bank said it responded quickly to mitigate operational impacts.
Chain IQ revealed that the cyber attack targeted it and 19 other companies, with some data published on the darknet. The firm stated that countermeasures were immediately implemented to contain the situation but declined to comment on ransom demands or communications with attackers due to ongoing investigations.
KPMG, listed as a Chain IQ client, said its infrastructure remained unaffected but enhanced its security protocols in response to the breach.
Pictet reported that only invoice-related information involving some of its suppliers, such as technology providers and consultants, was stolen. The private bank reassured that client data remained secure and stressed the importance of strict controls to prevent unauthorized access.
Swiss financial regulator Finma is overseeing the case according to standard procedures.
Cybersecurity expert Ilia Kolochenko of ImmuniWeb warned that breaches at third-party vendors pose a significant risk even to top financial institutions, potentially affecting the long-term trust in Swiss banking.