Incorrect e-mail addresses in a customer system

Swisscom had 39 incorrect e-mail addresses in one of its customer systems. E-mails from Swisscom to residential customers for whom one of these e-mail addresses had been stored were sent to other people’s e-mail accounts. The reason: Customers themselves and individual customer advisors had entered what they thought were non-existent e-mail addresses in the Swisscom customer system. Swisscom immediately rectified this issue once it became aware of it and is currently modifying the customer system in such a way that this cannot happen again.

By Armin Schädeli

29 August 2019

Swisscom holds several million e-mail addresses. In one of its customer systems, 39 e-mail addresses were found that were not assigned to the correct e-mail accounts of the respective customers. E-mails from Swisscom to approximately 600 residential customers for whom one of these e-mail addresses had been stored were sent to other people’s e-mail accounts. These e-mails included marketing material as well as information on bills (without call charge data) or order confirmations. Swisscom was notified of this by third parties whose e-mail addresses received e-mails from Swisscom that were not destined for them.

This is how the e-mail addresses got into the system

Customers themselves and individual customer advisors had entered what they thought were non-existent e-mail addresses in the Swisscom customer system. If customers ordered a product, modified a contract or entered into a new contract, the customer system asked for an e-mail address. When customers did not want to provide this address, they themselves or individual customer advisors entered what they thought were non-existent addresses (e.g. Xyz123@bluewin.ch), assuming that these were not assigned to real people. Such e-mail addresses are often registered as disposable addresses to avoid advertising e-mails. However, 39 of these apparently unassigned e-mail addresses were registered by real people, with the effect that e-mails from Swisscom were sent to e-mail inboxes for which they were not destined.

Immediate measures taken

Once it became aware of the issue in March 2019, Swisscom identified the incorrect e-mail addresses and immediately ensured that they would not receive any further e-mails from Swisscom. Furthermore, Swisscom is also in the process of adapting the system in such a way that customers have to verify their e-mail addresses. Swisscom has not received any indication that the information has been misused.

Communication with the approximately 600 customers affected by this issue is underway. Swisscom apologises for the incident. The first priority was to technically protect the system and therefore the customers, to get a complete overview of the situation and then provide transparent information. Swisscom provided a statement to the Federal Data Protection and Information Commissioner (FDPIC) in May.

Downloads

Swisscom Newsletter

Erhalte Medienmitteilungen und News

Klimabeitrag

Unsere Abos sind inklusive Klimabeitrag

Connect Testsieger Mobilfunk und 5G-Netztest

Connect Testsieger Festnetztest landesweite Anbieter