Cyberattack steals data belonging to hundreds of Swiss broadcaster staff

Around 340 current and former SRF employees have had personal workplace data exposed after a cyberattack on the Swiss Broadcasting Corporation, the parent company of Swiss public media outlets including German language broadcaster SRF.

The stolen records contain names, job titles and professional contact details. Some private contact information was also included. The SBC said the data mainly concerns staff from SRF’s current Information department, with records dating from 2020.

The incident matters because the broadcaster handles sensitive work across newsrooms, production teams and administrative operations. Employee directories can help attackers map an institution, identify targets and craft convincing messages, even when more sensitive systems remain protected.

The SBC reported the breach on September 28, 2026. It said there was no indication that the information had been published or misused. The company also said it had found no evidence that other SRF units were affected.

The disclosure gives the public a limited but important picture of the attack. Investigators still need to establish how the attackers entered the system, how long they had access and whether they copied anything beyond the identified staff records.

Names, roles and contact details were taken, while the most sensitive categories identified by the broadcaster remained untouched.

The compromised information included professional contact details, such as work addresses and other organisational data, alongside some private contact details. These records can reveal reporting structures and working relationships inside a large media organisation. They may also expose former employees who no longer expect their details to sit inside active institutional systems.

The SBC said there was currently no indication that passwords or financial and banking information had been affected. It also reported no evidence that journalistic sources, research data or communications content had been accessed.

That distinction is significant for SRF’s newsroom operations. Source protection and confidential communications are central to public interest reporting, particularly when journalists work on politically sensitive, criminal or security related stories. The available information does not show that those materials were reached in this incident.

The broadcaster has kept its public account focused on confirmed findings. It has not identified the attackers, disclosed the attack method or said whether the records appeared online. Those questions remain part of the investigation involving internal and external specialists.

The SBC moved to contain the incident as soon as it discovered unauthorised access. The broadcaster said it deactivated the affected access points and introduced additional security measures.

It also filed a criminal complaint, placing the case with law enforcement as investigators work to determine the cause and full extent of the intrusion. Internal and external specialists are cooperating in the inquiry. The company has not publicly assigned responsibility for the attack.

The broadcaster said current information showed that no further unauthorised access had taken place and that the incident was under control. It also said staff in other units did not appear to have been affected.

Those measures reduce the immediate risk, but they do not close every issue raised by the breach. Investigators must verify the boundaries of the affected system, check whether the stolen records were copied or transferred, and assess which current and former employees face a heightened risk of targeted phishing or impersonation.

The company’s response also illustrates the practical demands of breach management. Public institutions must secure systems, preserve evidence, inform affected people and maintain essential services at the same time. The SBC’s criminal complaint and continuing investigation mark the incident as a security matter, not simply an internal data protection problem.