UBS Employee data exposed in ransomware attack on third party supplier Chain IQ
Learn More
Switzerland-based investment bank UBS Group AG confirmed that sensitive employee data affecting approximately 130,000-137,000 staff members was stolen and published on the dark web following a ransomware attack on one of its third-party suppliers.
The cyberattack was claimed out by the ransomware group World Leaks, formerly known as Hunters International. They targeted Chain IQ Group AG, a Baar-based procurement services provider that was spun off from UBS in 2013. Chain IQ serves as a central procurement services provider for UBS and other major corporations, offering solutions in human resources, information technology systems, waste management, purchasing, and security services. The company maintains an international presence, and reportedly serves over 400 contractual partners.
The attack occurred in early June 2025, and the stolen data was published on the darknet on June 12, 2025. The stolen data included UBS employee information and Chain IQ's client database containing contract details, service agreements, and internal contact information. Exposed data includes:
- Names and email addresses of employees
- Landline phone numbers and mobile numbers (in some cases)
- Job positions and levels within the company
- Languages spoken by employees
- Office locations and specific floor assignments within UBS buildings
- Employee addresses and physical workplace details
- Direct phone number of UBS CEO Sergio Ermotti
Beyond UBS, the breach impacted other major organizations within Chain IQ's client portfolio. Swiss private bank Pictet confirmed that it was also affected by the attack, but the leaked information was apparently limited to invoice data and did not include client information.
Chain IQ claims to have implemented emergency response protocols following the attack, activating security measures and assembling a dedicated team of internal and external cybersecurity experts. The company has contacted Zug cantonal police and informed all internal and external stakeholders about the incident. Swiss financial market regulator FINMA confirmed it was aware of the incident and was handling it according to established procedures.
