Cyberattack exposes sensitive data from Swiss federal pension fund

Personal data belonging to people insured by Switzerland’s federal pension fund Publica may have been stolen in a cyberattack on a software provider, SRF reported. The potentially exposed information includes names, AHV numbers, addresses, salary details and pension savings.

Publica said the data may also include dates of birth, phone numbers, email addresses, marital status and details about spouses or partners. It is not yet known whether the incident affects all of the fund’s roughly 66,000 active members and 40,000 pensioners, or only some of them.

The pension assets themselves were not affected, Publica said. The fund warned that the stolen information could be misused to impersonate individuals or gain an advantage, and urged members to be cautious about unusual calls or messages.

The attack targeted PK Softech AG, a software provider to pension funds, rather than Publica directly. The Office of the Attorney General of Switzerland is investigating. Publica and federal experts are analysing the data that may have been taken. It remains unclear whether other pension funds were affected.

The incident recalls a 2023 cyberattack on software company Xplain, through which attackers accessed data from federal agencies. The Swiss government later introduced additional security requirements for working with IT suppliers.