HWZ service-provider data breach (Switzerland, 2026-08)

A Zurich business school tells students their bank details and sick-leave records were stolen — not from its own systems, but through the infrastructure of an IT service provider whose leak-site listing names seven other Swiss customers alongside it, and does not close the list

HWZ Hochschule für Wirtschaft Zürich, a Zurich university of applied sciences business school, wrote to its students and alumni to confirm that an analysis of stolen data had identified personal information belonging to them — names, addresses and phone numbers, records from student administration, bank details, and data from sick-leave notifications (Inside Paradeplatz, 2026-08-22). On where it came from, the school is specific and, notably, exculpatory of its own estate: "Nach aktuellem Untersuchungsstand erfolgte ein Angriff über die Infrastruktur des Dienstleisters" — according to the current state of the investigation, an attack took place via the service provider's infrastructure — and it states separately that HWZ's own local IT infrastructure was not affected. The school has involved the police and asked recipients not to circulate unconfirmed information.

Two days before that letter was reported, the extortion group Payload listed a Swiss data-centre operator on its leak site, claiming roughly 490 GB of data and naming eight affected customer domains — the school's among them, alongside seven other organisations. The listing gives only domain names; no cited source describes what those other customers do, and this entry does not guess. The timing is consistent with a single underlying event, and the school's own description of a provider-side compromise matches the shape of the listing. But the connection is not independently established: no source other than the leak-site listing itself links that named provider to HWZ. The school names no provider. Neither outlet covering the story names one through its own reporting. This entry therefore does not name the company either — naming a firm as breached on the unverified assertion of the group extorting it is exactly the failure mode this pipeline's sourcing rules exist to prevent, and a different provider name circulating in the primary's reader comments is speculation with no sourcing at all.

What is established is the structure, and it is the reason a Swiss federal SOC should care about a business school's mailing list. One managed-IT or hosting compromise produced simultaneous personal-data exposure at several independent organisations that had no intrusion of their own, no security failure of their own to remediate, and — in HWZ's case — no ability to tell affected people anything until the provider's investigation reached them. The named customer set is seven organisations plus one higher-education institution — and the listing ends that enumeration with "etc.", so eight is a floor rather than the full extent. That is the ordinary shape of a regional IT provider's book of business, and therefore the ordinary shape of this blast radius: the organisations that know they are affected are the ones the attacker chose to name.