Cyberattack exposes data of hundreds of SRF staff

About 340 current and former SRF employees have been caught up in a cyberattack on SRG SSR, the Swiss public broadcaster and Swissinfo's parent company. The stolen material includes names, job titles and work contact details, along with some private contact information. SRG SSR disclosed the incident on Monday, September 28, 2026.

The breach concerns records dating back to 2020. The affected files mainly relate to staff in SRF's current Information department, the German-language broadcaster's news and information operation. Employees in other SRG SSR units do not appear to have been affected, according to the company.

The incident has exposed an important layer of newsroom infrastructure even though there is no current evidence that journalistic content or sources were accessed. SRG SSR said it has found no indication that passwords, banking or other financial details, research data, or communications content were involved.

The broadcaster has not reported any misuse or publication of the stolen information. It said the incident is under control and that investigators have not identified further unauthorised access. The disclosure puts the focus on employee data protection, the security of public media systems and the potential risks created when professional and private contact details are held together.

Names, roles and contact details formed the core of the exposed data. SRG SSR said the records included professional contact information and some private contact details. Such information can help identify employees, map reporting lines and target individuals with convincing phishing messages, even when passwords and financial records remain untouched.

The broadcaster has not published a full technical account of the attack. It has said that the data belonged to current and former SRF staff and that the records date from 2020. The material mainly concerned the current Information department, narrowing the known scope of the breach but also highlighting the value of organisational data.

SRG SSR said there is no evidence that journalistic sources, research data or communications content were affected. That distinction matters for a broadcaster whose reporting often depends on confidential contacts and sensitive investigations. At this stage, the company has not linked the incident to any publication or misuse of the stolen information.

The available information also leaves key questions open, including how attackers obtained access, how long they remained inside the relevant systems and whether the data was copied in full. SRG SSR said its investigation will clarify the causes and extent of the attack.

SRG SSR moved to contain the breach after discovering unauthorised access. The broadcaster deactivated the affected access points and introduced additional security measures. It also filed a criminal complaint, bringing Swiss law enforcement into the response while technical specialists examine the intrusion.

The company said it has found no evidence of further unauthorised access. That assessment remains subject to the ongoing investigation, which involves both internal teams and external specialists. Their work is expected to establish how the attackers entered the system, what they accessed and whether any information left the broadcaster's control.

SRG SSR has not identified the attackers in the information available. Nor has it said whether the incident involved ransomware, a compromised account or a vulnerability in a digital service. Those details will be central to assessing the risk to other Swiss media organisations and public institutions.

The response follows a familiar pattern for data incidents: isolate affected systems, preserve evidence, strengthen access controls and notify authorities. For staff, the immediate concern is whether exposed professional or private contact details could be used in targeted fraud or impersonation attempts. The broadcaster's statement provides no evidence that such misuse has occurred.

The breach has not reached the level of a newsroom content compromise, based on current findings. SRG SSR said it has no indication that passwords, banking details, research material, journalistic sources or communications content were affected. It also said staff in other units do not appear to have been involved.

That information limits the known impact, but it does not remove the need for vigilance. Employee directories can reveal who works in a particular field, who manages a team and how an organisation is structured. Those details can support targeted attempts to obtain credentials or pressure staff into opening malicious links.

The incident also illustrates the challenge of protecting data belonging to former employees. The exposed records include information dating from 2020, showing that historical staff data remained part of the systems under investigation. Retention periods, access permissions and the separation of professional and private details will likely form part of the broadcaster's review.

For Switzerland's media sector, the case adds to a wider cyber-risk picture affecting companies, government bodies and public services. SRG SSR's investigation will determine whether its existing safeguards worked as designed and what changes are required across the organisation.

The next phase will be defined by the investigation, not by the initial disclosure. SRG SSR is working with internal and external specialists to determine the cause and extent of the attack. The broadcaster has not said when the intrusion began, how the unauthorised parties gained access or whether they removed all of the affected records.

The company said there is currently no indication that the stolen data has been published or misused. It also reported no further unauthorised access after it deactivated the affected access points and added security measures. Those findings could change as forensic work continues and investigators examine system logs, user accounts and stored records.

A criminal complaint gives Swiss authorities a formal role in the case. The outcome could clarify whether the attack was directed at SRG SSR specifically or formed part of a broader campaign against organisations holding staff and organisational data.

For affected employees, the practical risks centre on unwanted contact, impersonation and phishing. SRG SSR's continuing updates will be important, particularly if investigators identify additional data categories or evidence that the information has circulated. For now, the broadcaster's public account remains limited to the known exposure of contact and organisational details affecting about 340 people.