Publica, the pension fund for the Swiss federal government, confirmed on October 8, 2026, that member data leaked after a cyberattack on one of its external software suppliers. The supplier detected the attack at the end of September. Publica's own press release says "Datenabfluss bestätigt" (data outflow confirmed), and Switzerland's Office of the Attorney General has opened a criminal investigation. Publica has not said how many people are affected. Its membership is reported as anywhere from about 66,000 active insured members and 42,000 pensioners (Publica's own boilerplate) to roughly 70,000 active members and 41,600 pensioners at the end of 2025 (swissinfo, cited by The Next Web and RTS). Publica told members that pension assets are safe, and no payment disruption or financial loss has been reported.
What Happened
All accounts agree on the basic timeline. A software supplier to Publica found an intrusion at the end of September 2026 and filed a criminal complaint right away. It then notified the relevant federal offices, Publica and its other customers. The federal statement and Publica's press release (carried by Swiss-Press) both say no other federal body does business with the supplier. BlackTree points out that this limits the exposure to the federal government only through this supplier. It does not rule out separate, unrelated incidents.
Publica's notice does not name the supplier. Streamline Feed reports that the Swiss outlet Watson identified it as PK Softech AG, a company that develops software for pension funds. According to that report, PK Softech said in its own notice that malware was used to reach part of its IT infrastructure. The company says it isolated the affected environment, brought in outside specialists and restored customer services from October 2. Publica has not publicly confirmed the vendor's identity, and Tech-Insider said that as of October 8 no outlet had independently verified it.
Accounts differ on how confirmed the leak is. Publica's release headline says data left the supplier. The body of the same release says the supplier and federal offices are still working out how much Publica data is involved. Streamline Feed reports that PK Softech told Watson the confirmed exfiltration came from its own infrastructure and not from customer systems, and that it had not yet established whether customer data was in what was taken. Read together, the most defensible position is this: data was confirmed stolen from the supplier, Publica treats its members' data as leaked and has notified them, and the exact field-level and record-level scope is still under investigation.
What Was Taken
Sources disagree here too. The incident summary and Tech-Insider's headline describe three types of member data. Several reports, including Publica's public release, The Next Web, RTS and Analytics Insight, say the specific data types had not been disclosed.
The most detailed account comes from SRF/RSI, which saw Publica's letter to members. According to that letter, the data that may have been taken about insured members and pensioners includes:
- Full name and date of birth
- AHV/AVS number (the Swiss social security number)
- Postal address
- Private and work phone numbers
- Private and work email addresses
- Pension data, such as salary and retirement savings balance
- Marital status
- Data on spouses or partners
These nine fields look like the "three types" in other coverage broken out in more detail: identity data, contact data and pension or financial data. That mapping is our reading and has not been confirmed by Publica. RSI says it is unclear whether all active members and pensioners are affected or only some of them. RSI also gives a third set of membership figures: about 66,000 active members and 40,000 pensioners.
The data is highly sensitive. A national ID number combined with salary, savings balances and family details is enough for convincing identity fraud and targeted social engineering. Publica spokesperson Beatrice Rychen told SRF: "For us, this is the worst thing that could have happened."
Why It Matters
Publica covers staff of the federal administration, the ETH Domain and about 70 affiliated organisations. Its total assets are reported at just under CHF 45 billion. A leak of salaries and AHV numbers for federal employees, researchers and their partners is a ready-made targeting list. It could be used for fraud, and also for intelligence-driven pretexting against government staff.
This is also Switzerland's second major federal data exposure that came through a supplier. In 2023, the Play ransomware group published data stolen from Xplain, an IT contractor serving the army and customs service. RTS places the Publica incident in a recent wave of Swiss intrusions that includes CHUV, the FOITT (OFIT), RUAG and Stadler Rail. Tech-Insider links it to a wider 2026 supply-chain campaign that hit EY and Advantest, but no other source supports that connection and it should be treated as unverified.
The central lesson: Publica's own systems were not reported breached, yet its members still bear the full exposure. Specialist pension software vendors often hold or process complete member records, which makes them a concentrated single point of failure.
The Attack Technique
Very little is public. No threat actor has claimed the attack, no ransomware group has been named, and no CVE or initial access vector has been disclosed. The only technical detail comes from PK Softech's notice as reported by Streamline Feed: malware was used to access part of the supplier's IT infrastructure, and the supplier then isolated the environment. Customer services were restored on October 2, which points to an operational disruption at the vendor that lasted at least several days.
The pattern of malware, exfiltration from vendor infrastructure and service downtime fits a double-extortion ransomware operation. That is an inference, not something any source has confirmed. If a leak-site posting appears, it will be the first independent evidence of what was taken.
What Organizations Should Do
- Map which vendors hold your member or employee data. List every supplier that stores, processes or receives extracts of personal data, including test and support copies, and record the specific fields each one holds.
- Demand an evidence map after any vendor incident. As BlackTree recommends, ask the supplier for affected services, data flows, access identities, integrations, preserved logs and the window of suspicious activity. Require it to separate data that was viewed, queried, exported and confirmed lost.
- Minimise what vendors keep. Pension and HR software vendors rarely need permanent copies of full national ID numbers or complete salary histories. Use contracts to require tokenisation, retention limits and deletion of support data.
- Prepare members for phishing that uses their own data. Tell affected people to verify any message about the incident through a Publica channel they find themselves, and never through links or phone numbers in an unexpected message. Warn them that attackers may quote their real salary or AHV number to seem credible.
- Watch for misuse of national ID numbers. Work with social insurance and banking partners to flag unusual changes to accounts linked to exposed AHV numbers, especially changes to payout bank details.
- Test vendor notification paths. The supplier here notified customers and authorities quickly. Make sure contracts require that speed and name who receives the alert on your side.
Sources: Swiss Pension Fund Hack: 3 Data Types Leaked Oct 2026 | Swiss prosecutors investigate data leak at federal pension fund Pub... | Cyberangriff auf Softwarelieferant von Publica: Datenabfluss bestät... | Nomi, numeri AVS e stipendi: ecco i dati rubati a Publica - RSI | Publica Leak Confirmed | Publica : fuite de données après une cyberattaque RTS | Swiss Pension Fund Publica Hit by Data Leak After Cyberattack | Swiss Pension Fund Probes Possible Exposure After Supplier Attack...