Supplier hack leaks UBS data – including CEO's phone number

By Nicole Kobie for IT PRO
Thursday, June 19, 2025

• 563
• More

The incident is just the latest to target a bigger company via its suppliers or partners, with 97% of American banks hit by third-party data breaches in 2024.

"From the technical viewpoint, this incident is a grim reminder that third parties are the Achilles' Heel even of the largest financial institutions," said Dr. Ilia Kolochenko, CEO at ImmuniWeb and a Fellow at the British Computer Society (BCS).

ChainIQ has many big-name banks as customers, and though others haven't yet confirmed they were victims of the attack, it could prove to have serious implications for the wider industry.

"Before the exact scope of the alleged data breach is known and verified, it would be premature to make final conclusions," Kolochenko said in a statement sent to ITPRO. "However, based on the publicly available data, this data breach may have a disastrous and long-lasting impact on the Swiss banking industry, given that UBS is the largest financial institution of the country."

While no client data was lost, the information on employees that was stolen could be used by hackers in a number of ways, including future scams, fraud, and phishing attacks, with the data used to help impersonate bank employees, he said.

"The wide availability of generative AI tools, capable of impeccably impersonating voices and even videos, may certainly amplify the consequences of the data breach," he added. "Worse, some of the stolen data may be exploited to blackmail bank employees or even facilitate money laundering via sophisticated social engineering operations."

To help avert the worst of that impact, Kolochenko called for UBS to notify employees and customers of the potential risks. "From the legal viewpoint, the question of liability is complex, however, it is perfectly possible that the bank may eventually be liable to the victims for the damage suffered as a result of the attack," he added. Read Full Article