Anonymous Switzerland Warns Efadah: 40 GB Data Sale Looms

Anonymous Switzerland has given the Saudi company behind efadah.com.sa another 48 hours to respond before it offers roughly 40 GB of data for sale, according to two posts the group published on a public channel on October 14, 2026. The group says the files include bank cards, ID documents, passports, driver’s licenses, and confidential company data.

If the clock started with the first post, the window closed on or around October 16. No company reply, price listing, or sale notice appeared in the material CyberAsia.io reviewed. The dataset has not been independently confirmed.

What Anonymous Switzerland Posted About Efadah

The first post is written in Swiss German and carries artwork of the Saudi and Swiss flags bound by a padlock and chains. It names the company as «Efaad» and links to efadah.com.sa. Earlier attempts to get an answer went nowhere, the group says, so the company gets another 48 hours to get in touch.

If nothing arrives, the data goes up for sale. On top of the categories above, the post cites data from over 2,000 bank cards.

The second half of the post is the unusual part. Anonymous Switzerland asks Saudi media outlets and news broadcasters to forward its notice, plus a data sample, to the company. In effect, the group wants the press to act as its messenger and add public pressure.

It also warns that the data could be misused for bank fraud or document forgery, and calls this the last deadline before the next step. That reads as much like a warning to the public as a threat to the company.

Inside the Data Sample Shared by Anonymous Switzerland

A second post, stamped 11:23 on the channel against 10:51 for the first, adds a visual sample. The image is a collage of a file explorer window and several close-ups. Dozens of thumbnails are visible, each carrying the efadah.com.sa domain and the group’s name as a watermark.

Some thumbnails resemble blue bank card images. Others look like scanned forms or spreadsheet rows with Arabic text and date columns. The pictures are small, so individual fields cannot be read, and CyberAsia.io has not tried to extract any personal details.

In the caption, Anonymous Switzerland says this is only a small part of what it holds. Without a reply within 48 hours, it says, all of the data will be sold at a very low price, and the company will face legal consequences for the unlawful outflow.

Watermarking every sample file is a familiar tactic. It makes the images harder to reuse and easier to attribute, but it does not show where the files came from, how old they are, or whether they match live records.

Who Is Anonymous Switzerland?

Anonymous Switzerland uses the familiar Anonymous mask paired with a small Swiss shield and tags its posts with #Anonymous_Switzerland. The two posts reviewed drew 187 and 176 views, which points to a small audience at the time of capture.

Neither post explains how the files were obtained. There is no mention of an intrusion method, a software flaw, or a third-party supplier. The text talks about a sale, a deadline, and legal consequences rather than a political cause.

In CyberAsia.io’s assessment, that mix of Anonymous branding and a countdown to a sale sits closer to data extortion than to classic protest hacktivism. It fits a wider pattern. Cyfirma’s October 2025 threat report on Saudi Arabia noted a sharp rise in the sale of Saudi government and corporate data on dark web forums, alongside hacktivist activity tied to regional tensions.

What Is Still Unknown in the Efadah Case

Several basic questions remain open.

• Authenticity and age. The sample could be genuine, recycled from an older leak, or stitched together from several sources.
• Origin. The files might come from the company’s own systems, a vendor, or a partner.
• Scope. “Data from over 2,000 bank cards” could mean card images, card numbers, or full customer records.
• Identity. The text spells the name «Efaad» while the link and watermark use efadah.com.sa. Several Saudi organizations use similar spellings, so the domain is the only reliable identifier.

Why the Data Types Raise the Risk

If the files are genuine, the mix matters more than the size. Bank card data can feed fraud attempts, although one-time passcodes and bank-side monitoring limit direct misuse. Passports and driver’s licenses are a different problem. They support identity fraud and forged paperwork, and they cannot be reissued as quickly as a card.

Combined with names and phone numbers, the data can also fuel convincing phishing calls. Confidential company records add risks such as invoice fraud against partners and suppliers.

Saudi Arabia’s Personal Data Protection Law, supervised by SDAIA, sets obligations for organizations that hold personal data, including duties when a leak occurs. A confirmed exposure would carry regulatory weight on top of reputational damage.

Steps for Customers and the Company

For people who have dealt with the company:

• Check bank statements and turn on transaction alerts. Ask your bank about reissuing a card if you are worried.
• Treat calls, SMS, and emails that mention your documents or card details with suspicion.
• Do not download leaked files or contact the sellers. Such files can carry malware.

For the company’s security team:

• Review access logs, cloud storage permissions, file shares, backups, and vendor accounts for unusual transfers.
• Rotate passwords and API keys, and enforce multi-factor authentication.
• Preserve evidence, bring in incident responders, and notify the regulator and affected banks if the leak is confirmed.

Related CyberAsia.io coverage of data extortion threats against Gulf companies

FAQ

Q1 : Has Efadah confirmed a data breach?

No public confirmation was found in the material CyberAsia.io reviewed. The only source is the posts by Anonymous Switzerland.

Q2 : Is the 40 GB dataset real?

The posts alone cannot answer that. The watermarked thumbnails look like cards, forms, and spreadsheets, but they say nothing about origin, age, or accuracy. Only the company or a regulator with access to the files can settle it.

Q3 : What happens now that the deadline has passed?

Anonymous Switzerland says it will announce the sale publicly and sell the data at a very low price. CyberAsia.io saw no such listing in the reviewed material. A quiet deadline does not prove the data is fake, and it does not mean anyone is safe.

Q4 : Should customers contact Anonymous Switzerland or open the files?

No. Contacting sellers invites more pressure and scams, and leaked files often carry malware. Contact your bank instead and watch for suspicious messages.

Disclaimer

This article is published for cybersecurity awareness and educational research only. CyberAsia.io reports on public statements by threat actors and does not endorse or take part in any illegal activity. Details come from public posts and have not been independently confirmed. Readers should rely on official statements.