r/Switzerland • u/CloeHernando Bern • 1d ago

Recent surge in data breaches

Spinning this off the Republik-Thread.

Is it selection bias or are we experiencing a lot of these at high-profile targets in Switzerland at the moment?

If this is in fact a trend, is it world-wide? AI-related (could be both on the attacker's and the victim's side)?

53 Upvotes

94% Upvoted

34 comments sorted by

•

u/AutoModerator 1d ago

Hi! Don't forget to participate in our current event! Swiss Food Week! more information...

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

28

u/Sad_Alternative_6153 1d ago

Start mandating data audits on companies and fining them whenever they collect data they don't absolutely need or don't encrypt the rest. They will suddenly get much more cautious

6

u/FlippinHeckles 1d ago

This. However we will have to expect the cost of the audits will be put on the consumers. Nothing is for free.

1

u/GardenIntelligent643 1d ago

That's not how economics work. All companies are already charging as much as they possibly can for their products to maximise profit, if they're not, they're not doing their duty to shareholders.

If their cost base goes up, that doesn't increase the amount they can charge customers, unless it's such an across-the-board cost rise that all companies can raise prices in sync.

5

u/FlippinHeckles 1d ago

An audit would be a across the board price rise if every business had to do it. So yes it would work this way.

1

u/GardenIntelligent643 1d ago

Competent companies should already be doing this

2

u/FlippinHeckles 1d ago

They are not because it costs. There are more incompetent businesses out there than you think, even well performing ones.

1

u/tzt1324 1d ago

Supply and demand. Two lines meet at a certain point. If you increase the cost for every one the line will move in a certain direction.

23

u/Swigor 1d ago

It's worldwide. AI makes it very easy for hackers. There should be a law that makes paying ransom illegal if there is no life threat. Some swiss cyber insurances even have paying ransom money in their contracts. That's insane.

12

u/HastyLemur201 1d ago edited 1d ago

There should be a law that makes paying ransom illegal if there is no life threat.

Better yet, there should be laws to make companies infinitely liable if anything that could have been patched wasn't, and another, at the EU level, to mandate hardware manufacturers to quickly patch all known vulnerabilities for 10 years from the last date of sale of all products.

8

u/Classic_Court1003 1d ago

Cybersecurity is pretty much neglected, that's the quantity issue. No money for it until something happens which threatens the CEO and his minions position.

Another one is the type of hire for cybersecurity positions in Swiss companies. The Swiss prefer the soft skills instead of hard skills. Apparently the hackers are not impressed.

5

u/candycane7 1d ago

At work I have noticed a very big increase in spam emails recently, all my colleagues also. It's quite well crafted emails using employee's names and fake company emails.

1

u/Tegeret Aargau 1d ago

Yup, my inbox has been getting flooded throughout the few months now mostly with dubious crypto emails although it has been very clean pre-2025. My email has been leaked in db’s even before covid and it definitely matches up with the timeframe of ai models experiencing major advancements.

3

u/Chefseiler Zürich 1d ago

Republik and Publica both were not the actual target of the attack but customers of the company targeted. SRG phrasing also sounds a bit like an application used by a department was affected and SRG wasn't necessarily the target. Ricardo seems to have been the target. Whether in purpose or because they exposed something that shouldn't have been exposed is hard to tell right now.

So the attacks weren't necessarily aimed at Swiss high profile companies. If there is a wave, AI is certainly a factor but more because hackers are using it while adoption in prevention is lacking behind, so this is more of a temporary issue. GitHub code can be automatically scanned for vulnerabilites but I don't know how many companies are actually using this feature (if they even use GitHub).

3

u/eazy_osm 1d ago

I'd say that AI has made it easier for attackers to create and execute supply chain attacks (https://www.cloudflare.com/learning/security/what-is-a-supply-chain-attack/).

It changes the threat model quite significantly. In the olden days you'd usually be targeted specifically. Now, they can just take the shotgun approach of infecting a commonly used dependency in a popular language, and wait. It's much less effort to find targets.

Most companies that aren't banks, or otherwise have reasons for very high security, won't be prepared for this and will likely have developer laptops that are infected without knowing it. All of the companies linked aren't prepared for this.

5

u/fryxharry 1d ago

Putin is probably mad because we didn't agree to his Neutralitätsinitiative.

2

u/heliosh 1d ago

AI makes it easy to exploit security vulnerabilities, so this isn't going to stop anytime soon

3

u/rezdm Zug 1d ago

Yes, it is all across cyber security.

Next question.

2

u/ExtraTNT Bern 1d ago

Ai: you can use it to attack, but it does not allow you to find issues in your own software, while it writes absolutely shit code, that looks good and works for demos, so passes reviews…

2

u/One_Day_Sober 1d ago

I mean those developers/testers could have used the same AI to try and hack their own software, no? That might help to find vulnerabilies

1

u/swisstraeng 1d ago

Yes and we actually do that. However the issue is that a full time software developer is not a full time hacker, so by default he's at a disadvantage.

Another issue is that there is a significant amount of leaked data that was "accidentally" leaked because legally you can't do that.

"Oh no we lost all your data, we owe your government 2 millions!" meanwhile receives 5 millions from the hacker under the table.

•

u/314159265358969error Valais 14h ago edited 14h ago

Every line of code you write is a maintenance liability. Trivial vulnerabilities should obviously be fixed by the devs, and AI is marginally useful for that (considering devs are usually quite good at spotting most things already, especially with TDD).

The problem is that solving non-trivial vulnerabilities may often be a bigger liability than mitigation. There the 10€/100€/1000€ lock problem really starts showing up (aka increasing the size of your trusted computing base costs salaries/tokens exponentially).

1

u/kai45456 1d ago

it's definitely concerning to see these high-profile breaches popping up in such quick succession. i've noticed more phishing attempts at work too, so I think it's part of a broader trend. companies really need to step up their cybersecurity measures, i'd guess it’s only gonna get worse unless they do something drastic. stronger regulations might help push them in the right direction

1

u/crud_despair 1d ago

you should look at the data breaches in France this last year lol

1

u/AutomaticAccount6832 1d ago

It also means on the positive side that such cases are found almost live and published soon after.

So before maybe we and probably not even the company affected may have known.

Would be interesting if that changed because of regulatory pressure or what reasons.

1

u/gradientbresson 1d ago

Worldwide, thanks to LLMs.

•

u/SpiritedInflation835 8h ago

One factor is that people have access to powerful AI now. Checking companies for security flaws is a lot easier nowadays.

Heck, you can task an AI agent with creating social media profiles, chatting up with people from specific companies, and try to make them click on a link.

•

u/RecognitionHefty 2h ago

The CIO of my employer, a very wealthy multinational company, recently told me that I need to adjust a slide that (with a citation, mind you) remarked that "AI reduces the time between vulnerability detection and exploitation". He had me write "AI is a unprecedented tool to defend against cyber attacks".

We started red teaming our chat bots with prompts that might make fun of politicians. I don't think there's any more sophistication in our "defense against cyber attacks" that he's introduced in the last 5 years.

1

u/HF_Martini6 Zürich 1d ago

You should see my cyber security feed.

as u/rezdm said, next question?

0

u/SuddenBus 1d ago

lol! No data breach! They are selling our personal data.