UBS data breach history (2016-2026): the Chain IQ supplier leak and Credit Suisse’s insider cases
UBS’s best-known incident is the June 2025 leak of employee data from Chain IQ, a procurement supplier it spun off in 2013. Since UBS took over Credit Suisse in 2023, this page also covers Credit Suisse’s 2023 insider incidents. Each item is dated and sourced.
Short answer
Was UBS hacked?
We found no confirmed breach of UBS’s own systems from 2016 to 2026 in the sources we read. In June 2025 UBS said “a cyber attack at an external supplier has led to information about UBS and several other companies being stolen.” The supplier was Chain IQ; Swiss newspaper Le Temps reported data on about 130,000 UBS employees, including a direct line for CEO Sergio Ermotti, was published on the darknet. UBS said no client data was affected. The World Leaks group claimed the attack.
Before UBS took it over, Credit Suisse reported two insider incidents in early 2023: a former employee copied staff pay and bank details to a personal device, and, according to a letter reported by the New York Post, a former employee copied personal data of clients with $50 million or more at the bank.
Timeline at a glance
18 Jun 2025UBS confirms employee data stolen in a cyberattack on supplier Chain IQ; no client data affected. (Reuters)Confirmed
18 Jun 2025Le Temps: data on about 130,000 UBS employees published. (SiliconANGLE)Reported
11-12 Jun 2025World Leaks lists Chain IQ and claims ~910 GB; Chain IQ says it was attacked on 12 June. (SecurityWeek)Unverified claim
Mar 2023Credit Suisse letter: a former employee copied data of $50M+ clients (per New York Post). (The Swiss Times)Reported
Feb 2023Credit Suisse tells staff a former employee copied 2013-2015 pay and bank data. (eFinancialCareers)Confirmed
Last updated November 13, 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.
UBS incident timeline, in detail
Confirmed = acknowledged by UBS, a regulator filing or a court. Reported = credible reporting UBS has not fully confirmed. Unverified claim = an attacker or leak-site claim.
Jun 2025ConfirmedThird-party / procurement supplier
Supplier Chain IQ hit by World Leaks; UBS employee data published
What happened. Chain IQ, a Baar-based procurement provider spun off from UBS in 2013, said it was attacked on 12 June 2025 along with 19 other companies and that the data was published on the darknet that afternoon. It said the incident was “contained after 8 hours and 45 minutes.” UBS confirmed the impact. Pictet also confirmed it was affected. The World Leaks group (formerly Hunters International) listed Chain IQ on its leak site on 11 June and claimed about 910 GB, or more than 1.9 million files.
Impact. Per Le Temps, reported by SiliconANGLE: about 130,000 UBS employees’ names, email addresses, phone numbers, roles, languages and office locations, and a direct line for CEO Sergio Ermotti. UBS said “No client data has been affected.” Chain IQ said no bank customer data was compromised. FINMA said it was aware and handling it under established procedures.
Mar 2023ReportedInsider (Credit Suisse, before the UBS takeover)
Credit Suisse: former employee copied data of its wealthiest clients
What happened. The New York Post reported, and The Swiss Times summarised, that Credit Suisse wrote to clients with $50 million or more on deposit saying an employee who has since left “inappropriately copied this information without Credit Suisse’s authorization” to a personal device.
Impact. Reportedly Social Security numbers, employment details and contact information. The letter said there was no evidence of misuse and enrolled clients in Experian IdentityWorks. No count was published.
Mar 2021 – Feb 2023ConfirmedInsider (Credit Suisse, before the UBS takeover)
Credit Suisse: former employee copied staff pay and bank details
What happened. Credit Suisse emailed current and former staff in February 2023 that a former employee with legitimate access had copied salary and bonus data for 2013 to 2015, and the bank accounts used to pay them, to a personal device. It first identified the issue in March 2021 and obtained a search and seizure order.
Impact. Thought to be thousands of staff, per eFinancialCareers. The bank said there was no evidence of onward transmission, informed regulators and data protection authorities, and offered 12 months of Experian monitoring.
How many UBS employees? Le Temps (via SiliconANGLE) says about 130,000; the Reuters report says “tens of thousands” in one place and “thousands” in another. UBS has not given a number in the sources we read.
Attack date: World Leaks listed Chain IQ on 11 June 2025, a day before the 12 June attack date Chain IQ gives (SecurityWeek).
Credit Suisse clients: the $50M-client letter is reported second-hand (New York Post via The Swiss Times); we have not seen the letter.
The pattern across the record
Former in-house functions become third-party risk
Chain IQ was spun out of UBS and still held a directory of its staff. Data that used to sit inside the bank sat at a supplier that was hit along with 19 other clients.
Insiders with legitimate access
Both Credit Suisse incidents were staff copying data they could see for their jobs to personal devices, found long after the fact.
What it means for UBS For UBS and former Credit Suisse clients and employees — and what to do
Clients were not affected by the Chain IQ leak, but staff names and direct numbers make impersonation easier.
1.Verify any “UBS” contact through a known channel
Leaked staff names, titles and phone numbers help scammers pose as your adviser. Call back on a number you already have.
We found no confirmed breach of UBS’s own systems from 2016 to 2026. In June 2025 UBS employee data was stolen in a cyberattack on its supplier Chain IQ and published on the darknet. UBS said no client data was affected.
UBS data breach 2025: what happened?+
The World Leaks group attacked Chain IQ, a procurement supplier spun off from UBS, on or around 12 June 2025. Le Temps reported data on about 130,000 UBS employees was published, including a direct line for CEO Sergio Ermotti.
Was UBS client data stolen in the Chain IQ attack?+
UBS said “No client data has been affected,” and Chain IQ said no bank customer data was compromised. The leaked data was employee business contact details.
Did Credit Suisse have a data breach?+
Yes, two insider incidents reported in early 2023, before the UBS takeover: a former employee copied staff pay and bank details, and, per a letter reported by the New York Post, a former employee copied data of clients with $50 million or more.
More in the Breach Index
Same sourced, verification-tagged timeline, company by company — compare how peers have fared.
Independent analysis for security-leadership education; not affiliated with or endorsed by UBS. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.