Attackers broke into PK Softech AG, a software supplier to Publica, the pension fund of the Swiss Confederation. They took roughly 100 GB of compressed data on current and former federal employees. Publica says it is still working out how many of its members are affected. Its membership was about 66,000 active members and 40,000 pensioners according to SRF, or about 70,000 and 41,600 at the end of 2025 according to The Swiss Press. Tages-Anzeiger reporting, carried by bluewin, 20 Minuten and 20 minutes, puts the exposed population at "well over 100,000" people. That reporting also names the Akira ransomware group as the attacker. Bluewin reports that Akira is demanding a ransom and threatening to publish or sell the data. Neither Publica nor the federal government has publicly confirmed Akira's involvement in the material available here. Both have confirmed the breach itself, and the Office of the Attorney General has opened a criminal investigation.
What Happened
- Intrusion: Bluewin reports that PK Softech AG, based in Reinach, Basel-Landschaft, was hit during the night of 28 to 29 September 2026. The Swiss Press says the supplier detected the attack at the end of September, filed a criminal complaint, and notified federal authorities, Publica and its other customers.
- Disclosure: On 8 October, Publica and the federal government said data had leaked. Publica did not name the supplier at first. It said other federal agencies have no business relationship with the company (The Swiss Press).
- Scope of compromise: PK Softech says the attack targeted its own infrastructure, not its customers' systems. It took the affected systems offline and brought in outside experts (bluewin).
- Escalation: On 18 October, the SonntagsZeitung reported on a confidential note from Karin Keller-Sutter that called the attack "serious" for national security (20 minutes). On 20 October, Tages-Anzeiger wrote that the stolen data is "far more serious for Switzerland's security than previously communicated."
- Government response: Citing Tages-Anzeiger, 20 Minuten reports three measures:
- The Federal Intelligence Service (NDB) has suspended foreign operations, because data on officers working under cover identities may have leaked.
- The Federal Security Service has tightened protection of government members.
- The Confederation is setting up a task force.
- Wider campaign: Bluewin reports a separate attack on a different IT provider serving the FAR construction-industry retirement foundation. The pension funds of the Canton of Bern, Swiss Post and Migros are checking whether their members are affected. Nothing in these sources ties the FAR incident to Akira.
What Was Taken
Publica's notice to members, as reported by SRF, says the following data on active members and pensioners may have leaked:
- Name and date of birth
- AHV/AVS social security number
- Postal address
- Business and private email and phone numbers
- Pension data: salary, insured earnings, pension savings
- Marital status
- Details of spouses or partners
20 Minuten's German and French editions add IBAN to this list. Publica's own list, as quoted by SRF, does not include it. Treat bank account details as possible but not confirmed by the victim.
Publica says the pension assets themselves are safe (SRF, bluewin).
Tages-Anzeiger reports that the affected people include:
- cleaning staff and ordinary administrative employees
- federal judges and anti-mafia investigators
- intelligence officers and elite soldiers
- former Federal Councillors
Sitting Federal Council members were reportedly not affected. On volume, all outlets cite the same figure of about 100 GB compressed. The headcount ranges from Publica's own uncertainty (some or all of roughly 106,000 to 111,600 members) to Tages-Anzeiger's "well over 100,000," which also covers federal-affiliated organisations.
Why It Matters
This is a supply-chain breach with national-security consequences. Publica's own systems were not breached. A niche software vendor held a large copy of its member data, and that copy was taken. A payroll and pension dataset normally counts as a privacy problem. Here it apparently includes intelligence personnel and special forces, which turns it into a counter-intelligence problem. Real names, birth dates, addresses and family details can be linked to cover identities. The NDB's reported pause on foreign operations shows the government is treating that risk as real.
Fraud is the more immediate threat. Tages-Anzeiger reports that the State Secretariat for Security Policy has already seen convincing scam attempts. Bluewin describes fraudulent calls in fluent Swiss German to pensioners who had just been warned about the breach. Callers who already know a victim's salary, AHV number and spouse's name will be very persuasive.
The incident also fits a pattern. The Swiss Press notes that aerospace supplier Beyond Gravity recently disclosed an intrusion dating back to mid-August. In both cases, an outside contractor was the weak point, not the institution.
The Attack Technique
There is no public technical account yet of how PK Softech was breached. For defenders, the best available reference is a Huntress report published on 6 October that reconstructs a separate Akira intrusion from September. Threadlinqs has summarised it. Nothing in these sources links that case to PK Softech. Treat it as an example of how Akira operates, not as the account of this breach. According to Huntress and Threadlinqs, the actor:
- Initial access: logged in over RDP from an external workstation named
C1IFRYXI(T1021.001). - Defence evasion: stopped Bitdefender services and disabled antivirus.
- Credential access: dumped LSASS memory with
procdump.exe(T1003.001). - Staging: placed Rclone and a GOST tunnelling tool in
C:\PerfLogs. GOST was likely used for persistence. - Exfiltration: sent data out with Rclone before encryption.
- Impact: deleted shadow copies with PowerShell (T1059.001), then encrypted folders on network shares.
Huntress notes that its agent was installed only after the compromise. Much of this picture comes from Registry shellbags, event logs and Akira's own log files. Threadlinqs rates the attribution of that case as medium confidence.
What Organizations Should Do
- Inventory data held by vendors. Find out which suppliers hold bulk copies of employee, payroll or pension data, and in what form. A 100 GB compressed archive sitting with a vendor is as serious an exposure as one on your own servers. Require minimisation, encryption at rest, and deletion once data is no longer needed.
- Close exposed RDP and enforce MFA on remote access. Akira commonly gets in through RDP and VPN. Block RDP from the internet, put remote access behind MFA, and alert on logins from unfamiliar workstation names.
- Watch for the pre-encryption steps. Alert on security services being stopped,
procdumprunning against LSASS, binaries running fromC:\PerfLogs, Rclone or GOST being used, andvssadminor PowerShell deleting shadow copies. - Monitor outbound traffic for bulk exfiltration. Flag large or long-running uploads to cloud storage and unusual tunnelling traffic, especially from file servers and domain controllers.
- Treat staff with sensitive roles as a separate risk group. Where HR or pension data covers intelligence, law enforcement or military staff, apply stronger controls. Prepare plans for contacting and protecting those people if the data is exposed.
- Warn affected people about targeted scams now. Tell them that callers may already know their personal details. Give them a callback number they can verify. Remind them that the fund will never ask for credentials or payments by phone.
Sources: Hackers Steal Data and Blackmail Switzerland | Up a Creek Without a Command Line: Mapping an Akira Ransomware Atta... | Cyberangriff Akira: Daten von Bundesangestellten geklaut - 20 Minuten | Cyberangriff auf Publica – diese Daten sind betroffen - News - SRF | Cyberattaque en Suisse: données d'ex-conseillers fédéraux volées pa... | Federal Pension Fund Publica Reports Data Breach After Supplier Cyb... | Pension Fund Data Breach: Which Funds Are Affected and What You Nee... | Akira Ransomware Attack Reconstructed Threadlinqs