After the pension fund hack: What happens now?
The Federal Data Protection and Information Commissioner has opened a formal investigation into PK Softech AG. According to media reports, hackers stole data belonging to over 100,000 federal employees from the software supplier for Publica.
The Federal Data Protection and Information Commissioner (FDPIC) is targeting PK Softech AG. The company, based in the Basel region, develops software for pension funds. On October 8, the company reported an attack on its IT infrastructure to the FDPIC. Now, the FDPIC has opened an investigation into PK Softech.
What happened?
At the end of September, cybercriminals breached the systems of PK Softech and stole data from various pension funds and their insured members. This includes Publica, the federal pension fund. Following the report on October 8 and an informal preliminary inquiry with the victim, Publica, a formal investigation has now been launched due to suspected violations of data protection law.
The FDPIC first wants to determine what personal data the pension funds had entrusted to PK Softech in the first place. Furthermore, the authority is examining the legal basis on which these data transfers took place, how the parties involved implemented them, and what (and how much) information was actually leaked.
Source: edoeb.admin.ch
FDPIC Adrian Lobsiger does not rule out extending the investigation of PK Softech to federal bodies (e.g., Publica) at a later stage. He stated this to Blick. The number of reported data security breaches has also risen sharply. There have been 455 so far in 2026 – compared to only 343 reports in the entire year of 2025. However, most of these are attributed to human error.
Who are the cybercriminals?
As the Tages-Anzeiger reports, the perpetrators are members of the «Akira» group. In this hack, they are said to have stolen around 100 gigabytes of data. The group is now demanding a ransom for it. If the affected authorities do not pay, the group intends to sell the data or publish it on the darknet.
The problem is that this data concerns practically all current and former federal employees – over 100,000 people. The data collection includes names, dates of birth, AHV numbers, addresses, salary information, telephone numbers, email addresses, and bank details. It also includes marital status and data on partners and, in some cases, children.
As Watson writes, federal agencies fear a danger to certain employees, such as staff of the Federal Intelligence Service, the Federal Police, and the «Defense in the DDPS» group. There is a risk that criminal groups could, for example, track down individuals with undercover identities. The Office of the Attorney General of Switzerland is also investigating this matter.
Other employees or former employees should also be on the lookout for phishing attempts.
I've been tinkering with digital networks ever since I found out how to activate both telephone channels on the ISDN card for greater bandwidth. As for the analogue variety, I've been doing that since I learned to talk. Though Winterthur is my adoptive home city, my heart still bleeds red and blue.
From the latest iPhone to the return of 80s fashion. The editorial team will help you make sense of it all.
Show all
