Pension fund data breach: Why companies in Switzerland face hardly any fines

Names, AHV numbers (Switzerland’s social security numbers), salaries, pension savings: Such details on tens of thousands of insured persons may have been in the hands of criminals since late September. At the time, unknown perpetrators used malware to gain access to part of the IT infrastructure of PK Softech AG, a developer of pension fund software based in Reinach in the canton of Basel-Landschaft. On Oct. 8, 2026, the Federal Council confirmed a data leak at this supplier to Publica, the federal government’s pension fund. Since then, the City of Zurich pension fund and the pension fund of the canton of Ticino have also announced that their members’ personal data was probably stolen.

The federal government itself regards the data breach at PK Softech as serious: In a confidential information note, it calls the incident “grave,” according to Blick. The case raises a question that was already left unanswered after the attack on the IT company Xplain in 2023: who is accountable when a company cannot protect the data entrusted to it. Swiss law offers a terse answer. The Federal Data Protection and Information Commissioner (FDPIC) cannot impose fines. Under the Federal Act on Data Protection (FADP), only those who act intentionally are criminally liable. In principle, it is individuals who are fined, not companies.

What happened at Publica’s supplier

According to the Federal Council, the software supplier itself detected the attack. It immediately filed a criminal complaint and informed the relevant federal agencies, Publica and other customers. PK Softech said the affected environment had been “immediately disconnected from the network” and that outside specialists had been brought in. “We deeply regret the incident.” The company clarified to Watson: “The confirmed data leak came from PK Softech’s IT infrastructure, not from our customers’ systems.” The Office of the Attorney General is investigating. According to the Federal Council, no federal agencies other than Publica have business relations with the company.

The ties go back a long way. Publica has been using a pension administration application from PK Softech since 2017; the contract was awarded at the time for 12.6 million francs, covering a maximum term of 16 years including options, Inside IT reports. At the end of 2025, Publica had around 70,000 active members and 41,600 pensioners, and its total assets amounted to 44.9 billion francs. Those insured include employees of the federal administration and of the ETH Domain.

According to Publica, the data possibly affected includes surnames, first names, dates of birth, AHV numbers, addresses, phone numbers and email addresses, as well as pension data such as salary, insured salary and pension savings, plus marital status and information on spouses or life partners. The pension assets themselves are not affected. “For us, it’s the worst thing that can happen,” Beatrice Rychen, the fund’s head of communications, told SRF.

Reporting by the Tages-Anzeiger, cited by Netzwoche, Inside IT and Watson, goes further. According to it, some of the records also contain bank details and information about children. The employer can also be seen, the report says, even for people who work for fedpol or the Federal Intelligence Service under a cover identity. According to the report, the Federal Council and the security authorities assume that data on virtually all current and former employees of the federal government and of federally affiliated companies has leaked, with the sole exception of the sitting members of the Federal Council. Publica does not confirm this scope. “Which persons and data are actually affected is still the subject of extensive inquiries,” Rychen said on Oct. 20, 2026. “The inquiries are still ongoing,” she told Watson on Oct. 23, 2026. As of Oct. 30, 2026, no confirmation or correction of the scope had come to light.

Which pension funds are affected

According to the FDPIC, data from several major pension institutions of the second pillar, Switzerland’s system of occupational pensions, was siphoned off in the attack. The authority names only Publica. According to a report in the NZZ am Sonntag cited by blue News, just under a dozen other funds are affected, including those of Migros, Swiss Post and the City of Zurich. No complete list is available.

The City of Zurich pension fund (PKZH) has given a detailed account. According to the fund, in the worst case the data affected includes name, date of birth, AHV number, address, contact details, insured salary, pension savings, marital status, partner details and the IBAN. “Pension assets and pensions are not at risk,” the PKZH said. It has filed a criminal complaint. On Oct. 9, 2026, the canton of Bern reported an attack on an external software supplier to pension funds, without naming the company. According to blue News, the Swiss Post pension fund said on Oct. 13, 2026, that its data held by the supplier was anonymized. On Oct. 16, 2026, according to Inside IT, it confirmed that personal data had leaked at the supplier; whether its members’ data was affected remained unclear, it said.

Ticino has since joined the list. According to Tio, the cantonal pension fund IPCT is a customer of PK Softech. According to RSI, it has written to around 17,000 active members and 10,000 pensioners. There is no firm evidence, the fund said, but it seems likely that data on around 1,800 people was actually stolen. For around 1,700 people who left the fund or died in 2024 and 2025, the data mainly concerns personal details, AHV numbers and the amount of their termination benefit, as well as the new pension institution and its IBAN. The files contained personal IBANs for around 50 people to whom the amount was paid out directly. For around 80 recipients of a disability pension, the information extends to their degree of disability. The IPCT has also filed a criminal complaint.

Based on what is known so far, the FAR foundation, which organizes flexible retirement in the main construction industry, is not part of this case. Its IT partner was also attacked, but according to blue News, it is a different provider. The foundation warned around 20,000 retirees by letter.

Why federal data sat with a private company

It is basically nothing unusual for a software company to have access to personal data, cybersecurity expert Marc Ruef told SRF. Some vendors run the program for their customers themselves, on their own computers. In addition, the vendor needs to be able to see into the system when a bug has to be fixed. “Anonymizing and pseudonymizing data is very laborious and also prone to error,” Ruef says. And further: “Sometimes people choose cost-effectiveness over security.”

Which of these setups applied in the PK Softech case has not been established. The company told Watson: “In principle, there is no unmasked data on our test systems.” The PKZH presents things differently. It is planning to switch to PK Softech’s administration system and had sent the company data for that purpose. “This data was used as part of tests for the planned system change,” the fund said. These are precisely the questions the FDPIC now wants to clarify. In general, the federal data protection commissioner, Adrian Lobsiger, calls for only the most essential data to be transferred and for anonymized test data to be used in preference to production data, according to Inside IT.

When choosing a supplier, security issues really ought to come first, Ruef believes. “Experience shows that cybersecurity is often not very high on the list.” The blogger Jean-Pierre A. Kousz sums up the problem in a formula: “Anyone who outsources data does not get rid of the risk, only of the control.” He does not accuse anyone of ill intent: “No one is acting maliciously, but everyone is simply acting out of convenience.”

The trail to Akira

Neither the federal government nor Publica has confirmed who is behind the attack. According to reporting by Tamedia, the federal agencies involved assume that the ransomware group Akira carried out the attack. The group is said to be demanding a ransom and threatening to publish or sell the data. The amount demanded is not known. According to Watson, Akira’s dark web site contained no entry on the attack as of Oct. 20, 2026. No reports of the data being published had come to light by Oct. 30, 2026.

Akira has been active since March 2023 and uses double extortion: The group steals data and encrypts systems. In October 2025, the Office of the Attorney General, fedpol and the Federal Office for Cybersecurity (FOCS) issued a joint warning about it. The number of victims in Switzerland had already risen to 200 companies, and the authorities were currently registering four to five cases a week, they said at the time. According to the FOCS, Akira was the most active ransomware group in the country in 2025; the number of its known attacks rose from seven in the first half of the year to 26 in the second.

A federally owned company has paid before, too. After an Akira attack on its U.S. subsidiary in the fall of 2025, Ruag transferred a relatively small sum. “We paid and, fortunately, got all the data back,” Jürg Rötheli, the chairman of the board, told SRF in June. Mauro Tuena, a National Council member for the Swiss People’s Party (SVP) and a security policy specialist, warned at the time: “This hacker group now knows that the federal government is willing to pay ransoms.”

The number of ransomware incidents known to the FOCS fluctuates. There were 39 in the first half of 2024 and 57 in the first half of 2025. Since the second half of 2025, the office has also recorded reports from national partners; by this method, there were 79 cases each in the second half of 2025 and in the first half of 2026. “The threat from ransomware remains high for Swiss companies,” Max Klaus of the FOCS told Watson in June.

A pattern since Xplain

The pattern is not new. In May 2023, the ransomware group Play attacked the IT company Xplain AG, which supplied software to fedpol and the Federal Office for Customs and Border Security (FOCBS). In 2024, the FDPIC found failings on the part of both the federal government and Xplain. Fedpol and the FOCBS had not clearly agreed on the conditions under which personal data could be kept on the company’s servers during support work. Xplain lacked adequate data security measures, and data was retained despite deletion obligations that had in some cases been agreed by contract.

The federal government responded at the time with a package of measures. In April 2024, the State Secretariat for Security Policy (SEPOS) presented nine measures, including standardized contract clauses for suppliers, documented deletion of federal data, and checks and audits. Whether these rules also applied to Publica has not been documented. “Neither the Federal Council nor any department exercises a supervisory function over Publica,” the Federal Department of Finance told Blick.

The PK Softech data breach and Swiss law

On Oct. 22, 2026, the FDPIC opened a formal investigation into PK Softech AG. It aims to obtain a full picture of the personal data that the pension institutions transferred to the company, to clarify the legal framework for these transfers and to determine the extent of the information that leaked. “These are ongoing proceedings; both the attorney general and I are investigating,” Adrian Lobsiger said in an interview with Blick published on Oct. 24, 2026. “But I do not rule out extending the proceedings later to federal bodies, that is, pension funds.”

The yardstick is the fully revised FADP, which has been in force since Sept. 1, 2023. It requires data security appropriate to the risk. Anyone who entrusts data to a processor, such as a software supplier, must make sure that the processor is able to guarantee data security. A data security breach that is likely to result in a high risk to the personality rights or fundamental rights of the people concerned must be reported to the FDPIC as soon as possible by the controller, the party responsible for the processing. A processor reports it to the controller. PK Softech also reported the attack to the FDPIC on Oct. 8, 2026, as did affected pension funds. Failing to make such a report is not a criminal offense under the FADP.

The FDPIC can investigate and order that processing be adapted, suspended or terminated. What it cannot do is impose fines. “I cannot impose fines; Parliament did not want that,” Lobsiger says. “And Parliament also did not want it to be possible to sanction negligent conduct.” The FDPIC can file a criminal complaint only if intentional failures are suspected.

Lawyer Martin Steiger, who sits on the board of the digital rights group Digitale Gesellschaft Schweiz, describes how rare such proceedings are. “In practice, there appear to be hardly any criminal proceedings under the criminal provisions of data protection law,” he told Watson in June. In the canton of Zurich, he said, such cases are not even handled by the public prosecutor’s offices but by the district governors’ offices (Statthalterämter). His conclusion: “Looking at practice, the only conclusion one can draw so far is that fines for individual responsible persons are not effective.” Under civil law, those affected can sue for damages or for compensation for non-pecuniary harm. But that rarely pays off, Steiger says: The amount of such compensation is “notoriously low” in Switzerland, and the hurdles to proving damage are high.

The PK Softech case has an added peculiarity. Lobsiger describes the pension funds as federal bodies. According to their wording, however, most of the FADP’s criminal provisions apply to private persons. Insofar as the funds act as federal bodies, the provisions are therefore unlikely to apply to the people responsible within them; this is an inference from the text of the law, not a statement by Lobsiger. The provisions do apply to those responsible at a private company such as PK Softech. But even there, it would take intent, a request for prosecution and cantonal proceedings, usually against a specific person.

Supervision also has its limits. “Our resources are limited; we cannot supervise everything across the board, and often we can only carry out spot checks,” Lobsiger says. In the 2025/26 reporting year, the FDPIC received more than 2,000 reports of possible data protection violations; it conducted 22 preliminary inquiries and nine investigations. Reports of data security breaches are rising: “In 2025 there were 343; today we already have 455,” Lobsiger said in the same interview.

The duty to report to the Federal Office for Cybersecurity

The federal government takes a different approach with the obligation to report cyberattacks. Since April 1, 2025, operators of critical infrastructure have been required to report cyberattacks to the FOCS within 24 hours of discovering them. Since Oct. 1, 2025, fines of up to 100,000 francs have been possible under the Information Security Act; they are imposed on anyone who fails to comply with a legally binding ruling by the FOCS. In the first half of 2026, the office received 200 mandatory reports, plus 27,128 voluntary reports.

Whether pension funds and their software suppliers fall under this reporting obligation could not be conclusively determined for this article. There have been no reports on whether PK Softech or the funds notified the FOCS of the attack.

What the EU does differently

In the European Union, the General Data Protection Regulation (GDPR) relies on administrative sanctions against companies. Supervisory authorities can impose fines of up to 20 million euros or 4% of total worldwide annual turnover, whichever is higher. For infringements of the obligations concerning security of processing and the notification of personal data breaches, the regulation provides for a lower ceiling of 10 million euros or 2%. Personal data breaches must be notified to the supervisory authority without undue delay and, where feasible, within 72 hours, unless they are unlikely to result in a risk to those affected. Swiss law requires notification as soon as possible, but only where a high risk is likely.

A case from Ireland shows how high such fines can be. In December 2024, Ireland’s Data Protection Commission (DPC) fined Facebook’s parent company, Meta, 251 million euros. The fine stemmed from a 2018 data breach in which unauthorized parties had misused access tokens on the platform. Around 29 million accounts worldwide were affected, including around 3 million in the EU and the European Economic Area.

The EU also goes further on legal recourse: Under Article 80 of the GDPR, data subjects can be represented by organizations. In Switzerland, in Steiger’s words, there is “no class action and no right of associations to file complaints”; according to Watson, Parliament rejected the introduction of representative actions by associations and class actions in September 2025. He is calling for a change of system. “Data security breaches should hurt financially,” Steiger says. It should hit the companies themselves, “not just individual responsible persons.” Negligent data security breaches should also be covered, and sanctions should be “based on risk and turnover.”

The arguments against heavy corporate fines

The first argument against fines on the European model is the will of the legislature. The fully revised FADP, passed in Parliament’s fall session of 2020, does not provide for administrative fines; that was what Parliament wanted, Lobsiger says. He relies on a different tool. “But the effect of transparency should not be underestimated,” he says. He informs the public, he explains, when there is a general interest. “That motivates businesses to do more for data protection.”

Moreover, a company that is attacked is first and foremost a victim itself. PK Softech stresses that the attackers gained access “despite high security standards.” Groups such as Akira operate professionally. A fine would hit the victim a second time, while the perpetrators often remain out of reach.

Security also comes at a price. In his blog, Kousz estimates that audits, penetration tests, certifications and additional internal effort could raise software vendors’ prices by up to 20%. Finally, other levers already exist: the duty to report to the FOCS, the Information Security Act, clients’ contractual audit rights and the supplier rules the federal government adopted after Xplain. The FOCS also recommends conservative data storage: Data should be reviewed at regular intervals, and data that is no longer needed should be deleted.

What those affected can do now

For those insured, the risk is likely to persist for a long time. According to the federal government’s information note, active and retired employees must expect “longer-term repercussions.” “The federal security bodies are particularly affected,” the note states, according to Blick. Blick reports that employees could be recognized by the authorities of another country and questioned in depth or, in extreme cases, detained. According to Tamedia, an internal assessment speaks of a “danger to life and limb” for some of those affected. Tamedia also reports that State Secretary Markus Mäder has set up a task force headed by Anne Rivera, the federal government’s information security officer.

The immediate danger for most of those affected is fraud. In mid-October, the Zurich and Bern cantonal police warned of fraudsters posing as financial advisers or investment brokers who might know details of salaries and pension savings. Up to that point, the police had not registered any misuse of the data. The police advise people to remain suspicious of unexpected calls, not to disclose any further personal information and to verify the identity of a financial services provider through official channels. Publica’s advice is not to open suspicious links or attachments. Fraud attempts can be reported at cybercrimepolice.ch. On Oct. 20, 2026, the PKZH announced that it would send a letter to all its members that same week. It considers criminal complaints by individual members premature as long as the investigations have not been concluded; whether there is a claim for damages, and against whom, depends on the individual case, the fund said.

Anyone who wants to know whether their own data is affected can submit a request for information to the fund. “A request for information from the persons concerned must always be answered,” Steiger says. According to Lucien Jucker of the Stiftung für Konsumentenschutz, a consumer protection foundation, the information must in principle be provided within 30 days.

Arena: Should companies that lose customer data face heavy fines?

Commentary: Those who hoard data must be held liable

The PK Softech data breach exposes a gap that has been known since Xplain. A company manages the data of tens of thousands of insured persons, is attacked and loses it. Those affected will bear the risk for years to come. Under current law, the company risks next to nothing in criminal terms as long as no one proves that a specific person acted with intent. That is not a balance. It is an invitation to complacency.

Personal responsibility means that whoever makes the decision bears the consequences. Anyone who uses real personal data for tests, skimps on security or keeps data longer than necessary is making a conscious choice. Gross negligence in data security therefore belongs in the law. The company should pay, not a scapegoat from the IT department.

Switzerland does not need to copy the GDPR to achieve this. Fines of up to 4% of global turnover, imposed by an authority that both investigates and decides, are a poor fit for Swiss data protection law. Clear, limited sanctions decided by the courts are better. The federal government should also start with itself. Whether the supplier rules it adopted after Xplain also applied to the pension fund of its own employees is unclear. That finding alone is an embarrassment.

Paying a ransom would be the wrong way to go. Every payment finances the next attack. The hackers are the perpetrators, and no fine changes that. But anyone who hoards data they do not need makes the hackers’ job easy.

All figures as of Oct. 30, 2026. The federal government and Publica have not confirmed the information from the reporting by the Tages-Anzeiger and Tamedia on the perpetrators, scope, volume of data and task force; we found no confirmation or correction as of that date. We did not have access to the original article and quote it as cited by Netzwoche, Inside IT and Watson. We did not check Akira’s dark web site ourselves. The membership figures of the pension funds are not numbers of people affected. The legal situation is presented on the basis of the FDPIC fact sheet, the interview with Adrian Lobsiger and specialist sources; the text of the law is available on fedlex.admin.ch. We found no statements on the question of fines from business associations, the pension fund association or members of Parliament, even in a renewed search on Oct. 30, 2026. Quotes originally given in another language were translated by the editors. Sources are cited in their original language.

Related coverage: Social media ban for children: Europe draws the line, Switzerland hesitates · Brussels regulates, Zurich builds: How Switzerland is winning the AI race by staying out of it (in German) · 13th AHV pension payment: The people ordered it, now they are asked to pay

Sources

• Federal Council: Cyberangriff auf Softwarelieferant von Publica: Datenabfluss bestätigt (Oct. 8, 2026)
• FDPIC: EDÖB leitete nach Cyberangriff auf Softwarelieferant Abklärungen ein (Oct. 23, 2026)
• FDPIC: Tätigkeitsbericht 2025/26, press release (June 30, 2026)
• FDPIC: Merkblatt zur Untersuchung von Verstössen gegen Datenschutzvorschriften (as of September 2023)
• Blick: Mr. Datenschutz: «Die Bedrohung durch die KI ist real», interview with Adrian Lobsiger (Oct. 24, 2026)
• Blick: Daten-Debakel beim Bund: «Besonders betroffen sind die Sicherheitsorgane» (Oct. 18, 2026)
• SRF: Cyberangriff auf Publica: diese Daten sind betroffen (Oct. 8, 2026)
• SRF: Pensionskasse des Bundes: Wie konnten heikle Daten bei externer Softwarefirma landen? (Oct. 10, 2026)
• Inside IT: Datenabfluss bei Pensionskasse des Bundes (Oct. 8, 2026)
• Inside IT: Pensionskasse Stadt Zürich untersucht Datenabfluss (Oct. 16, 2026)
• Inside IT: Datenleck bei Publica gefährdet auch Sicherheitsbehörden (Oct. 20, 2026)
• Inside IT: Edöb untersucht Cyberangriff auf PK Softech (Oct. 26, 2026)
• Watson: Cyberangriff auf Software-Lieferanten des Bundes: Hacker erbeuten Daten (Oct. 8, 2026, updated Oct. 22, 2026)
• Watson: Cyberangriff betrifft auch Pensionskasse Stadt Zürich (Oct. 15, 2026)
• Watson: Nach Publica-Datendiebstahl: Ransomware-Bande Akira erpresst Bund (Oct. 20, 2026)
• Watson: Hackerangriff auf PK Softech AG: EDÖB startet formelle Untersuchung (Oct. 23, 2026)
• Watson: Interview with Martin Steiger on data breaches (June 11, 2026)
• Watson: Ransomware-Attacken, das BACS zu aktuellen Trends (June 29, 2026)
• Netzwoche: Ransomware-Gruppe Akira fordert Lösegeld für Daten von über 100’000 Bundesangestellten (Oct. 8, 2026, updates through Oct. 21, 2026)
• Cash (AWP): Angriff auf Publica-Lieferanten: Lohndaten könnten betroffen sein (Oct. 8, 2026)
• Finews: Hackerangriff auf IT-Dienstleister zieht weitere Kreise (Oct. 16, 2026)
• Digitec Galaxus: Nach PK-Hack: Sind auch andere Pensionskassen betroffen? (Oct. 12, 2026)
• PKZH: Cyberangriff PK Softech (as of Oct. 20, 2026)
• Polizeinews: Cyberangriff auf Pensionskassen-Zulieferer: Personendaten gestohlen (Oct. 18, 2026)
• Tio: Attacco hacker alle casse pensioni: a rischio anche i dati di 27mila ticinesi (Oct. 20, 2026, in Italian)
• RSI: Attacco hacker: esposti i dati di quasi 1’800 assicurati dell’IPCT (Oct. 23, 2026, in Italian)
• blue News: Pension Fund Data Breach: Which Funds Are Affected (Oct. 13, 2026, in English)
• blue News: Data on more than 100,000 insured individuals may have fallen into the hands of hackers (Oct. 18, 2026, in English)
• blue News: Hackers Steal Data from Soldiers and Former Federal Councilors (Oct. 20, 2026, in English)
• Jean-Pierre A. Kousz: Publica-Datenleck: Schon wieder der Lieferant, blog (Oct. 8, 2026, updated Oct. 14, 2026)
• Netzwoche: Ransomware-Bande Akira attackiert vermehrt Schweizer Unternehmen (Oct. 16, 2025)
• FOCS: Halbjahresbericht 2024/I (Nov. 7, 2024)
• FOCS: Halbjahresbericht 2025/II (March 30, 2026)
• Federal Council: Cyberbedrohungslage bleibt hoch: Angriffe werden gezielter und komplexer (March 30, 2026)
• Federal Council: Kennzeichnungspflicht wirkt, BACS-Halbjahresbericht 2026/1 (Aug. 24, 2026)
• Netzwoche: BACS zieht erste Bilanz zur Meldepflicht für kritische Infrastrukturen (Sept. 30, 2025)
• SRF: Trotz Warnung: Bundeskonzern Ruag zahlt Lösegeld an Hackergruppe (June 6, 2026)
• Berliner Zeitung: Schweizer Rüstungskonzern Ruag zahlte Lösegeld an Hackergruppe Akira (June 6, 2026)
• SRF: Nach Datenklau bei Xplain: Datenschützer sieht Fehler bei Bund und Xplain (May 1, 2024)
• DDPS/SEPOS: Massnahmenpaket zur Vermeidung künftiger Datenabflüsse (April 24, 2024)
• Federal Office of Justice: Datenschutz (Feb. 5, 2026)
• Fedlex: Bundesgesetz über den Datenschutz (DSG), SR 235.1
• Law.ch: Strafbestimmungen des nDSG
• EUR-Lex: General Data Protection Regulation, Regulation (EU) 2016/679
• FOCS: Merkblatt Meldepflicht für Cyberangriffe
• Federal Council: Sechs Monate Meldepflicht für Cyberangriffe auf kritische Infrastrukturen (Sept. 29, 2025)
• Netzwoche: Jetzt müssen kritische Infrastrukturen Cyberangriffe melden (May 23, 2024, updates through April 1, 2025)
• FDPIC: Leitfaden zur Meldung von Datensicherheitsverletzungen nach Art. 24 DSG (version 1.2, April 23, 2025)
• Law.ch: Meldung von Datenschutzverletzungen nach Art. 24 DSG
• e-recht24: Art. 33 DSGVO, Meldung an die Aufsichtsbehörde
• Dr. Datenschutz: Bussgelder und Sanktionen nach Art. 83 DSGVO
• TÜV Nord: DSGVO-Strafe, Bussgelder bei Datenschutzverstössen (Nov. 7, 2022)
• Law Society Gazette: DPC fines Facebook owner 251 million euros (Dec. 17, 2024)