Pension fund data leak: the FDPIC opens an investigation

On 22 October 2026, the Federal Data Protection and Information Commissioner (FDPIC) opened a formal investigation into PK Softech AG. The release is dated 23 October 2026. Data from several second-pillar pension funds were stolen in a cyberattack at this software supplier. Publica, the Federal Pension Fund, is named. The investigation does not yet say which persons are affected.

What happened

At the end of September 2026, PK Softech AG was the victim of a ransomware attack. Publica states that the attack was aimed at the supplier, not at Publica's own systems.

On 8 October 2026, PK Softech informed the FDPIC of a cyberattack and of possible breaches of data security. The funds concerned also reported the incident to the FDPIC.

On 14 October 2026, the FDPIC opened an informal inquiry with Publica. On 22 October 2026, it opened a formal investigation into PK Softech AG.

What the investigation is looking at

The FDPIC wants three things. To see the personal data that the funds made available to the supplier. To clarify the legal framework of those transfers and how it was applied. To establish the extent of the data that leaked.

The release says that no further information can be given on the proceedings that are under way.

What Publica has stated

Publica writes that its systems are not affected. Pension assets are safe. Pensions are paid as usual. The test environment at the supplier is separate from the system that pays the pensions. That system remains on Publica's infrastructure.

Publica cannot yet say which persons are affected, or how many. The data that may be affected are those of insured persons, pension recipients and former insured persons. They may include name, address, date of birth, OASI number, telephone number, email address and pension data, such as salary, insured salary and assets. For pension recipients, the IBAN may also be affected.

Publica has no indication that these data have been published on the dark web. It says it will inform people directly once it knows who is affected. On 8 October 2026, it wrote to insured persons for whom it has an email address. The others, and pension recipients, receive a letter.

On 15 October 2026, Publica filed a criminal complaint with the Office of the Attorney General of Switzerland.

Publica asks people not to answer messages that ask for personal or bank details.

The other funds named

The FDPIC release speaks of several major occupational pension institutions. It names Publica.

According to the Swiss news agency on 15 October 2026, the pension fund of the City of Zurich and the pension fund of Swiss Post stated that personal data had been stolen at an external provider. Assets and the payment of pensions were not affected. The Zurich fund also filed a criminal complaint.

The press has also named the Bernese Pension Fund and the Bernese Teachers' Insurance Fund. On 20 October 2026, the Bernese Pension Fund wrote that it still did not know whether its members' data had leaked. It filed a criminal complaint on 19 October 2026. It sends the registration papers for its portal by post only.

What the statute provides

The Federal Act on Data Protection (FADP) distinguishes the controller and the processor. The processor processes data on behalf of the controller.

Art. 8 FADP requires the controller and the processor to ensure, by appropriate organisational and technical measures, a level of data security adequate to the risk.

Art. 9 FADP allows processing to be assigned to a processor if a contract or the statute so provides, and if the data are processed only as the controller may process them. The controller must ensure that the processor is able to guarantee data security. Further subcontracting requires the controller's prior authorisation.

Art. 24 para. 1 FADP requires the controller to notify the FDPIC as soon as possible of a data security breach that is likely to result in a high risk to the personality or the fundamental rights of the data subject. The notification states at least the nature of the breach, its consequences and the measures taken or envisaged.

Art. 24 para. 3 FADP requires the processor to notify the controller as soon as possible of any data security breach.

Art. 24 para. 4 FADP requires the controller to inform the data subject where this is necessary for the person's protection, or where the FDPIC so requires. The controller may restrict that information, defer it or refrain from it. That includes the case where a public communication provides equivalent information.

A notification under art. 24 may not be used in criminal proceedings against the person required to notify, except with that person's consent.

The FDPIC is examining the framework of these transfers. It has not yet characterised it.

What the investigation does not decide

The formal investigation is not a judgment. It does not yet find a breach. It sets no fine. It does not say which persons are affected.

It does not cover every pension fund in Switzerland. It is directed at PK Softech AG, in respect of data from several institutions to which that company supplied software.

Publica has no indication of publication on the dark web. Press reports of 20 October 2026 mentioned data of former members of the Federal Council and an attempt at extortion. The FDPIC does not confirm that account. The proceedings are pending.

An OASI number, a salary and an IBAN are personal data. The investigation does not, by itself, place them among the sensitive data of the FADP. Sensitive data include, in particular, health, opinions, biometric data and criminal prosecutions.

The criminal complaints concern the cyberattack. They are not the FDPIC's decision.

Frequently asked questions

• Are the pension assets blocked? Publica writes that they are not. Its production systems are not affected. The pension continues to be paid. The pension fund of the City of Zurich said that its assets and the payment of pensions were not affected.
• Can a person already know whether they are affected? Publica does not know yet. It will inform people directly once it can identify them.
• What data may have leaked at Publica? Name, address, date of birth, OASI number, telephone number, email address and pension data may have. For pension recipients, the IBAN may have as well. The list of persons is not established.
• Has the FDPIC already sanctioned PK Softech? No. The investigation of 22 October 2026 is open. It finds neither a breach nor a fine.
• Is every Swiss fund affected? No. The FDPIC speaks of several major institutions that are clients of this supplier, including Publica.
• Have the data been published on the dark web? Publica writes that it has no indication of that.
• Should a person answer a message that asks for an IBAN or a password? Publica asks them not to answer. The Bernese Pension Fund sends the papers for its portal by post only.
• Does notification to the FDPIC count as an admission in criminal proceedings? No. A notification under art. 24 FADP may not be used in criminal proceedings against the person required to notify, except with that person's consent.

Avocados AI's Basic plan costs CHF 4.99 a month, the price of a coffee. It is there to organise the pension fund's messages, the notices received and the questions to ask. It does not replace a lawyer's review of the file. The Swiss data protection guide sets out the framework of data security and of notification to the Commissioner.

Sources

Federal Data Protection and Information Commissioner, release of 23 October 2026. Federal Pension Fund Publica, information on the cyberattack and criminal complaint of 15 October 2026. Swiss news agency, 15 October 2026. Bernese Pension Fund, release of 20 October 2026. Federal Act on Data Protection, arts. 8, 9 and 24. Only the official publication is authoritative.