Hack at external supplier exposes data of Publica pension fund members

At the end of September, a cyberattack hit an external software supplier of Publica, the Swiss federal pension fund. The case became public on Thursday. "Per noi si tratta della cosa peggiore che potesse accadere" (English: "For us, this is the worst thing that could have happened"), said the fund's spokesperson, Beatrice Rychen.

According to a notice sent by Publica to insured members, seen by SRF, personal data were probably stolen in the attack. The information involved is said to be sensitive, including first and last name, date of birth, social security number, address, private and work phone numbers, private and work e-mail addresses, pension data such as salary and pension assets, marital status, and information on spouses or partners.

It is not yet clear whether the data leak affects all of Publica's roughly 66,000 active insured members and 40,000 pension recipients, or only part of them. The pension funds themselves are not affected and remain secure, the institution states.

Risks for insured members

The theft of sensitive data exposes the people involved to the risk that the attackers try to assume their identity. Publica speaks of a "certain risk" for individual members and says it cannot rule out the data being misused to gain an advantage. The institution is urging members to be cautious about unusual phone calls or messages.

The attackers did not hit Publica directly, but the company PK Softech AG, an external software supplier that develops applications for pension funds. Through this breach, the attackers apparently also gained access to the federal pension fund's data. The Office of the Attorney General of Switzerland has opened an investigation into the case, while specialists analyze the stolen data. It is not known whether the attack also affected other pension institutions that are clients of PK Softech.

The incident recalls the 2023 Xplain case, a Swiss software supplier for public authorities: cybercriminals back then also managed to reach federal office data through an external company, stealing around 1.3 million sensitive files. Following an administrative inquiry, the Federal Council had set measures two years ago to prevent future data theft at IT suppliers, introducing additional security requirements for work with external companies.