Full Report
Der Schweizer Onlinehändler Offerz ist Opfer eines Hackerangriffs geworden. Dabei haben sich Unbekannte Zugang zu sensiblen Daten von rund 115'000 Kunden verschafft. Unbekannte verschafften sich in der Nacht vom 7. Oktober Zugang zu einer Testumgebung des Onlinehändlers, wie Blick am Mittwoch berichtete. «Unsere Systeme waren Ziel massiver Hackversuche, und solche Versuche halten weiterhin an», heisst es auf der Offerz-Webseite. In einem Fall gelang ein Zugriff auf eine Testumgebung, in der eine Kopie der Bestelldaten des Onlineshops offerz.ch aus dem Januar 2026 lag. «Der Zugriff erfolgte in der Nacht des 7. Oktober 2026 und wurde am Morgen des 9. Oktober 2026 entdeckt.»
Analysis Summary
# Incident Report: Unauthorized Access to Offerz Test Environment
## Executive Summary
The Swiss online retailer Offerz experienced a data breach where unauthorized actors gained access to a test environment containing a backup of production data. The incident compromised the personal information of approximately 115,000 customers. While no passwords or payment credentials were stolen, the company has implemented a mandatory password reset as a precautionary measure.
## Incident Details
- **Discovery Date:** October 9, 2026 (Morning)
- **Incident Date:** October 7, 2026 (Night)
- **Affected Organization:** Offerz (offerz.ch)
- **Sector:** E-commerce / Retail
- **Geography:** Switzerland
## Timeline of Events
### Initial Access
- **Date/Time:** Night of October 7, 2026.
- **Vector:** Exploitation of a test environment.
- **Details:** Attackers targeted a test environment that had access to a cloud storage bucket containing a January 2026 backup of the shop's order database.
### Lateral Movement
- **Details:** The report indicates the attackers moved from the test environment to an associated cloud storage containing historical production data.
### Data Exfiltration/Impact
- **Details:** While exfiltration was not definitively proven by logs, the company assumes the data was stolen. Compromised data includes: Names, physical addresses, email addresses, phone numbers, IP addresses, and payment method types.
### Detection & Response
- **Discovery:** Discovered by Offerz staff on the morning of October 9, 2026.
- **Response actions taken:** Deactivation of the test environment, locking of access credentials, system-wide security audit, and enforcement of a mandatory password reset for all users.
## Attack Methodology
- **Initial Access:** Targeting of non-production (test) infrastructure.
- **Persistence:** Not disclosed, though the company notes "massive hacking attempts" continue.
- **Lateral Movement:** Accessing connected cloud storage from the test environment.
- **Collection:** Accessing an old database backup (January 2026) containing customer order details.
- **Exfiltration:** Assumed via unauthorized access to cloud storage.
- **Impact:** Compromise of PII (Personally Identifiable Information) for 115,000 users.
## Impact Assessment
- **Financial:** Not yet disclosed; potential regulatory fines from FDPIC (EDÖB).
- **Data Breach:** ~115,000 customer records (Names, addresses, phone, IP, email, payment type).
- **Operational:** Test environment deactivated; mandatory password reset enforced for the entire user base.
- **Reputational:** High; public disclosure via national media (Blick, Watson).
## Indicators of Compromise
- **Network indicators:** Target domain: hxxps[://]offerz[.]ch.
- **Behavioral indicators:** Unauthorized access to cloud storage buckets from a test environment during non-business hours.
## Response Actions
- **Containment measures:** Deactivated the affected test environment and blocked compromised access points.
- **Eradication steps:** Verification and auditing of remaining systems to ensure no further footholds.
- **Recovery actions:** Implemented a mandatory password reset for all customers; reported incident to the Federal Data Protection and Information Commissioner (FDPIC/EDÖB) and the National Cyber Security Centre (NCSC/BACS).
## Lessons Learned
- **Data Hygiene:** A temporary database copy was created for technical work and not deleted upon completion, creating a "shadow data" risk.
- **Environment Separation:** Test environments should not have persistent or privileged access to production-level data backups.
- **Third-Party Risk:** The server operation and programming were managed by an external IT service provider, highlighting the need for stricter vendor oversight.
## Recommendations
- **Automated Deletion:** Implement automated lifecycle policies for temporary data backups to ensure they are deleted after a set period.
- **Least Privilege:** Restrict test environments so they cannot access production or sensitive backup storage.
- **Data Masking:** Use anonymized or "masked" data in test environments rather than raw production backups.
- **Monitoring:** Implement real-time alerts for unauthorized access to cloud storage buckets.