Cyberattack on Publica supplier may expose sensitive pension data

A cyberattack on software provider PK Softtech AG may have exposed sensitive data belonging to members of Publica, the Swiss federal pension fund, SRF reported. The information could include names, addresses, AHV social security numbers, salaries and pension balances. The scale of the possible leak and the members affected remain unclear.

The attack targeted PK Softtech, not Publica directly. Cybersecurity expert Marc Ruef said it was not unusual for a software provider to have access to clients’ personal data. He outlined two possible ways the information could have reached the company: the provider may host the software and store data on its own systems, or it may receive data while testing or maintaining a system.

During testing or repairs, software developers may be given information from live systems, including details about actual pension fund members. Companies could instead use anonymised or pseudonymised data, in which names and other personal details are removed or replaced.

Ruef said preparing such data was time-consuming and prone to error. Artificial test cases also do not fully reflect real-world conditions, leading some companies to test their software using real data. “Sometimes the decision is made in favour of cost-effectiveness rather than security,” he said.

Security should be a priority when choosing a software provider, Ruef said, but companies often focus first on the service and price. Clients can use contracts to secure the right to check how a provider handles their data, including through document reviews or on-site inspections.

If personal information is in circulation, criminals could use it to create more convincing phishing messages or to impersonate someone in fraud schemes. Ruef said people should be aware that their data may have been exposed so they can assess messages containing personal details with greater caution. Publica has also urged members to be wary of unusual calls or messages.