Unauthorized access to data: SWISS closes security gap and takes action

Due to an internal error, sensitive data from pilot assessments were unintentionally accessible for around two months – including to unauthorized individuals. An employee reported the incident, upon which SWISS immediately blocked access. Specialists closed the security gap and implemented additional protective measures. Other personal data, such as passenger information or data from other employees, were not affected. SWISS deeply regrets this data breach and is now reviewing processes to further safeguard sensitive data. 

On 1 August, Swiss International Air Lines (SWISS) was informed by an employee that sensitive personnel data from pilot assessments had been accessible for approximately two months to a large group of internal staff and a limited circle of partner company personnel. The cause was an error in the permission settings of the data storage (SharePoint). There was no hacking attack. 

Personal information of pilots who had previously undergone a selection process at SWISS was affected – including some external candidates for whom SWISS conducted assessments. These are sensitive data which include application documents, test results and expert assessments. Approximately 70 accesses to the data occurred. The individuals who accessed the data were contacted and informed about its sensitivity. They committed to immediately deleting the data and not sharing it further if they had downloaded it. 

No passenger data affected – data promptly migrated and secured 

Other personal data, such as passenger information or data of other employees, were never at risk. SWISS is committed to handling confidential data with the utmost care and protecting it by all means. We deeply regret that this error occurred. 

The error in the data storage settings was made by an employee and was a human oversight. Nevertheless, the responsibility lies with SWISS as a company. We take this responsibility seriously and acted immediately. 

The security gap was closed as soon as SWISS became aware of the issue. The data was moved to another secure platform, encrypted, and protected with additional measures. Since 1 August, the data has no longer been accessible to unauthorized people. We have informed the affected employees transparently. Data protection authorities as well as partner organizations, for whom SWISS conducted assessments, were also notified promptly. 

In recent days, we have thoroughly analyzed the incident and are implementing concrete measures to prevent such errors in the future. We are, of course, available to answer any questions from affected employees and partners. We deeply regret this incident and are committed to ensuring it does not happen again.