Cyberattack on PK Softech: system test data also affected
The City of Zurich pension fund had sent data to the provider ahead of a planned system switch. Publica and the Bernische Pensionskasse are still working out which of their insured members' data has leaked.
The cyberattack on PK Softech shows how far a data risk can reach even before a new software system goes live. The Pensionskasse Stadt Zürich (PKZH) had transmitted personal data to the provider for testing. In its current questions and answers, the fund speaks of data stolen from PKZH insured members and pension recipients as well. According to its update of 20 October 2026, it is not yet finally clear which details and which individuals are actually affected.
That leaves two questions standing side by side: data has leaked from the supplier's infrastructure. It does not follow that every file of every affiliated or future client was stolen. This distinction is decisive when assessing the growing number of pension funds that have been named.
The supplier was the target
PK Softech said that unknown parties gained access to part of its IT infrastructure using malware at the end of September. The company disconnected the affected environment from the network, brought in external specialists and filed a criminal complaint. Since 2 October it has been available to its clients without restriction again. The nature and extent of the data leak are being investigated.
The federal government confirmed a data leak at Publica's external software supplier on 8 October. The Office of the Attorney General of Switzerland is investigating. The statement names neither a final number of affected individuals nor all stolen data sets. A restored operation does not answer these questions.
Why test data is not a sideshow
PKZH currently uses a different administration system. The switch to PK Softech is planned for early 2027. The transmitted data was meant to help check whether the future portfolio is taken over completely and correctly.
The fund justifies the test with the need for a realistic mapping of pension relationships and points to contractual data protection and confidentiality arrangements. Whether the supplier met its protection obligations is under investigation. The incident alone does not permit a judgement on that. But it does make visible that data copies outside the running fund system also need protection. Looking only at live operations therefore falls short.
More than 100,000 possible affected persons is not a case count
Publica says it looks after around 70,000 insured persons and around 42,000 pension recipients. These portfolio figures illustrate the possible reach. They are not a count of proven data thefts. In its update of 20 October, Publica states that investigations continue into whether data actually leaked and from whom. There are no indications of publication on the dark web. An absence of publication does not mean that no theft took place.
More recent media reports go further: on 20 October, Watson reported, citing research by the «Tages-Anzeiger», that personal data of practically all federal employees may be affected. According to that report, the data is held by the extortion group Akira. Publica spokesperson Beatrice Rychen told Watson that the fund could not currently confirm the scope described. The more far-reaching claims are therefore to be classified as a media report, not as a publicly confirmed overall tally.
The Bernische Pensionskasse (BPK) also reported on 20 October that its specific exposure was unclear. It had filed an additional criminal complaint the day before. Already on 15 October, BPK had issued a correction to earlier supplier information: according to PK Softech, leaked personal data must now be assumed; the provider cannot say which clients are affected.
Regarding the service provider Libera, the NZZ reported on 17 October, citing its head Benno Ambrosini, that PK Softech had informed Libera on 14 October about leaked personal data. Whether specific funds administered by Libera or individual insured persons are affected can neither be confirmed nor ruled out. This too does not yield a reliable overall figure.
Personal details can make fraud credible
Among the potentially affected details, Publica names names, AHV numbers (Swiss old-age insurance numbers), salary and pension data, partner details and IBAN. At the same time the fund states that its systems for managing balances and paying out pensions are not affected; pensions would be paid as normal. Secure pension payments and a risk to personal data therefore do not exclude each other.
The Federal Office for Cybersecurity describes how fraudsters use trust and time pressure to obtain access data or money. Someone who knows personal details is therefore not a reliable sender. Publica recommends hanging up when in doubt about unexpected calls and reaching the organisation itself via its official contact details. Passwords or security codes do not belong in such conversations.
For insured persons it remains important to follow their own fund's communications and to verify unusual contact attempts. For the funds, the all-clear on payment operations is not enough: they must establish which data copies were held at the supplier and which individuals are actually affected. Only those findings turn a possible reach into a reliable tally.
Sources
- PK Softech: statement on the cyberattack
- Federal government: data leak at Publica's software supplier, 8 October 2026
- Pensionskasse Stadt Zürich: information and current questions on the cyberattack, as of 20 October 2026
- Publica: information and questions on the cyberattack, as of 20 October 2026
- Bernische Pensionskasse: information updates on the cyber incident, most recently 20 October 2026
- Publica: figures on insured persons and pension recipients
- Federal Office for Cybersecurity: recognising deception attempts and social engineering
- Watson: report on Akira and Publica's statement, updated 21 October 2026
- NZZ: further pension funds potentially affected and Libera's statement, 17 October 2026
