Incorrect e-mail addresses in a customer system
Swisscom holds several million e-mail addresses. In one of its customer systems, 39 e-mail addresses were found that were not assigned to the correct e-mail accounts of the respective customers. E-mails from Swisscom to approximately 600 residential customers for whom one of these e-mail addresses had been stored were sent to other people’s e-mail accounts. These e-mails included marketing material as well as information on bills (without call charge data) or order confirmations. Swisscom was notified of this by third parties whose e-mail addresses received e-mails from Swisscom that were not destined for them.
This is how the e-mail addresses got into the system
Customers themselves and individual customer advisors had entered what they thought were non-existent e-mail addresses in the Swisscom customer system. If customers ordered a product, modified a contract or entered into a new contract, the customer system asked for an e-mail address. When customers did not want to provide this address, they themselves or individual customer advisors entered what they thought were non-existent addresses (e.g. Xyz123@bluewin.ch), assuming that these were not assigned to real people. Such e-mail addresses are often registered as disposable addresses to avoid advertising e-mails. However, 39 of these apparently unassigned e-mail addresses were registered by real people, with the effect that e-mails from Swisscom were sent to e-mail inboxes for which they were not destined.
Immediate measures taken
Once it became aware of the issue in March 2019, Swisscom identified the incorrect e-mail addresses and immediately ensured that they would not receive any further e-mails from Swisscom. Furthermore, Swisscom is also in the process of adapting the system in such a way that customers have to verify their e-mail addresses. Swisscom has not received any indication that the information has been misused.
Communication with the approximately 600 customers affected by this issue is underway. Swisscom apologises for the incident. The first priority was to technically protect the system and therefore the customers, to get a complete overview of the situation and then provide transparent information. Swisscom provided a statement to the Federal Data Protection and Information Commissioner (FDPIC) in May.
Downloads
-
Press Release
(PDF file, 65 KB)
-
Picture
(JPG file, 11 MB)
Subscribe to news
Subscribe to our news by e-mail
Contact us
Address
Swisscom
Media Relations
Alte Tiefenaustrasse 6
3048 Worblaufen
Postal address:
Postfach, CH-3050 Bern
Switzerland
Contact
Tel. +41 58 221 98 04
media@swisscom.com