
Safety first: why amazingtoys.ch was briefly offline on 21 October 2026
On the afternoon of 21 October 2026, amazingtoys.ch and our app were unavailable for around three and a half hours. That was not an outage but our decision: we deliberately switched off our servers to protect your data. Here we explain in plain language, with no tech jargon, what happened and why your data is safe with us.
The most important points first:
- Safety comes first at AMAZINGTOYS®. Your data is always safe with us, including on that day.
- A security flaw was discovered worldwide in a technology used by almost every website. It had nothing to do with our shop in particular.
- We switched off our servers before anyone could have exploited the flaw on our side, and only restarted them after the security update.
- No customer data was accessed. You do not need to do anything, not even change your password.
- Orders, pre-orders and payments were preserved. The store in Zurich was open the whole time.
What happened? Simply explained
Imagine a fault is found in a door lock that is installed in millions of homes. That is exactly what happened on the internet on 21 October 2026. The technology affected is called PHP. It runs on a large share of all websites and online shops worldwide, including on our servers. Experts call the flaw «PHP2Shell».
The problem: through this fault, attackers could have accessed servers without a password and without anyone noticing right away. That is why many operators around the world temporarily took their sites offline, Wikipedia among them. Swiss media such as SRF, 20 Minuten, watson and the NZZ also reported on the flaw.

The maker of PHP released a security update around midday on 21 October. Until that update is installed on a server, the server remains vulnerable. That is exactly the window in which you could not reach amazingtoys.ch.
Why we switched off
We had two options: keep the shop online and hope nothing happens in the meantime, or switch the shop off until the update is installed. We chose to switch off. A shop that cannot be reached cannot be attacked.

That cost us a few hours of sales. In return, we could be certain that nobody could get at your data. For us, this trade-off always comes out the same way: your data matters more than an afternoon of sales.
Safety comes first at AMAZINGTOYS®. Your data is always safe with us. When in doubt, we would rather switch off than take a risk.
Thomas Kovacs, Managing Director AMAZINGTOYS®
This is how the afternoon went:
- From about 3.30 pm: amazingtoys.ch and the app go offline. We let you know on Instagram.
- Afternoon: The security update is installed and checked on all servers.
- From about 6.50 pm: Everything is running again. We check the shop, app, orders and payments and go back online.
Our review found no access to customer data. We switched the servers off before the flaw could be exploited, and only restarted them after the update.
What this means for you
In short: nothing. You do not need to do anything. Your password remains valid, your orders are there, and your payments were never affected.

Parcels that were ready to ship in the afternoon were processed after the restart. A delivery may therefore arrive a day later than planned. Thank you for your understanding. The AMAZINGTOYS® Store in Zurich was open as usual the whole time.
How we protect your data, every day
That afternoon was an exception. Protecting your data is not, that happens every day. Here is what it looks like in practice:

- No payment data with us: Credit card and bank details are not stored on our servers. They go directly to the payment provider.
- Encrypted connection: Every visit to amazingtoys.ch and every order runs over an encrypted connection. You can tell by the padlock symbol in your browser.
- Updates straight away: Shop and servers are updated continuously. Security updates always come first.
- Open communication: If something happens, we say so. On Instagram, here on the blog and by e-mail on request.
Tips against phishing: how to protect yourself
After incidents like this, scammers like to exploit the uncertainty. They send e-mails or text messages that look as if they come from a shop, in order to harvest passwords or payment details. This is called phishing. A few simple rules keep you on the safe side:
- Check the sender: Our e-mails come from an address ending in @amazingtoys.ch. Anything else: hands off.
- Do not click links in messages: If you are unsure, type amazingtoys.ch into your browser yourself or open the app. That way you are guaranteed to land with us.
- Never send your password or card details by message: We never ask for your password or payment details by e-mail, SMS, WhatsApp or chat.
- Pressure is a warning sign: «Act now or your account will be blocked» is a classic trick. Genuine shops do not threaten.
- One password per service: That keeps the damage small if another service is ever affected. A password manager helps.
- When in doubt, ask: Forward suspicious messages to service@amazingtoys.ch. We will tell you whether they are genuine.
Tip
A message that refers to this incident and asks you to enter your password or payment details is not from us. You do not need to do anything because of 21 October, and we will not ask you to.
Thank you for your understanding
A shop that is suddenly unavailable raises questions. Thank you for the many understanding messages that reached us on Instagram that afternoon. If you still have questions, write to us at service@amazingtoys.ch or drop by the store in Zurich.
Frequently asked questions
No. No customer data was accessed. If you would still like to renew your password, you can do so at any time in your customer account under «My account». What matters most is using a separate password for every service.
No. Credit card and bank details are not held on our servers but by the payment provider. They were never affected at any point.
All orders and pre-orders were preserved. Shipping continued after the restart, so some parcels went out a day later than planned. You can see the status of your order as usual in your customer account.
The update only became available around midday, but the flaw was already known before that. A server that is online and not yet updated can be attacked. Switching off was the only way to rule out that risk completely.
Our e-mails come from an address on @amazingtoys.ch and never ask for your password or payment details. If you are unsure, open the shop or the app directly and check your customer account there instead of clicking a link in the message.
Security flaws in widely used software can never be ruled out entirely, they affect the whole internet. What we can control is our response: install updates immediately, switch off when in doubt and communicate openly. That is exactly how we will act next time too.








