Hackers demand ransom for data stolen from Publica supplier

Hackers have demanded a ransom after stealing sensitive data in an attack on a software supplier to Switzerland’s federal pension fund Publica, SRF reported. The attackers threatened to publish or sell the data, and the Defence Department (VBS) is aware of the extortion, according to several sources.

Authorities believe the stolen information could potentially cover the entire federal workforce. It may include details about Federal Intelligence Service and Federal Office of Police (Fedpol) employees who work under false identities in Switzerland and abroad.

The software supplier, PK Softech AG, and Publica told SRF they had received no ransom demand. Cybersecurity expert Nicolas Mayencourt said he saw no reason to doubt their statements and suggested the hackers may have contacted the federal government directly.

The Office of the Attorney General of Switzerland has identified the Akira hacking group as the suspected attackers. Its initial investigation supports that conclusion, the office said. The case has been added to an ongoing investigation into attacks on Swiss companies between 2023 and 2025, which Akira claimed responsibility for.

More than a month after the attack, there is still no sign that the stolen data has been published. Mayencourt said the delay was unusual and offered three possible explanations: a ransom had been paid, Akira had sold the data, or negotiations were being prolonged for tactical reasons.

Mayencourt said criminal groups examine stolen data to assess ransom demands and identify potential buyers. Information that could expose intelligence officers may interest foreign intelligence services, he said, adding that criminal hackers increasingly cooperate with state actors. He also said intelligence services have sometimes used criminals to disguise their own attacks as ordinary ransomware extortion.

The Federal Office for Cybersecurity advises against paying ransoms or contacting attackers, and recommends notifying the police. The Defence Department said the federal government’s guidance had not changed but declined to comment on the ransom demands in the Publica case.

The Federal Council discussed the attack last Wednesday under confidentiality, government spokesperson Nicole Lamon confirmed. The Defence Department has previously criticised the state-owned arms company Ruag for not sufficiently considering political, reputational and other broader interests when it paid a ransom to Akira last year following an attack on its US subsidiary.