In short: A cyber attack on PK Softech AG, which supplies software to pension funds, has likely led to a leak of personal data of members of the Swiss Federal Pension Fund PUBLICA. The Office of the Attorney General of Switzerland is investigating. According to PUBLICA, pension assets are safe; but the case shows how heavily companies depend on the security of their suppliers.
Key facts
- Attack: at the end of September 2026, an external software supplier of PUBLICA detected a cyber attack; PUBLICA names it as PK Softech AG
- Federal government press release: 8 October 2026, “data leak confirmed”; the Office of the Attorney General has opened an investigation
- Data possibly affected (as of 8 October): name, date of birth, AHV (social security) number, address, phone numbers and email addresses, pension data (e.g. salary, insured salary, retirement assets), marital status, details of spouse or partner, IBAN
- Dark web: according to PUBLICA, no indication of publication so far (updates of 14 and 20 October)
- Others affected: other pension funds are also customers of PK Softech, including the City of Zurich Pension Fund (Pensionskasse Stadt Zürich, PKZH)
- Sources: federal government press release, PUBLICA and PKZH information pages
What is known
According to the federal government’s press release, the company informed the relevant federal offices, PUBLICA and other customers and immediately filed a criminal complaint. According to the federal government, no other federal offices have business relations with the company. As of the sources (20 to 22 October 2026), it had not yet been determined which individuals are specifically affected; neither the federal government nor PUBLICA gives a number of people affected.
According to PUBLICA, the incident concerns the supplier’s test environment, which is separate from the production pension system. Pensions are being paid as normal and members’ retirement assets are safe. On 15 October 2026, PUBLICA filed a criminal complaint against persons unknown with the Office of the Attorney General and reported the incident to the FDPIC.
The PKZH says it was informed on 13 October 2026. The data had reportedly been used for testing ahead of a planned system change; the PKZH’s current administration system is not affected. The PKZH has also filed a criminal complaint and reported the incident to its data protection office.
What affected individuals should do
PUBLICA and the PKZH advise extra caution with unexpected calls, emails and messages, especially about pensions, salary or banking. Never share login credentials, do not open suspicious links or attachments, and report unknown debits to your bank immediately.
What this means for Swiss SMEs
The case is not only relevant to pension funds. Many SMEs pass personnel data to fiduciaries, payroll providers or software vendors.
- Review suppliers: who holds which of your data, including in test or migration environments? Agree contractually that real data is not used for testing wherever possible.
- Know your reporting obligations: if there is a high risk to the people affected, you must report to the FDPIC as soon as possible; see Reporting obligations for cyber attacks.
- Prepare your emergency procedure: guide Cyber attack: what to do? and cyber risk check.
- Clarify coverage: whether incidents at service providers are insured depends on the contract. Check this in the comparison; the basics are covered in Cyber insurance for SMEs and Costs.