According to the Keystone-SDA agency, as reported by SWI swissinfo.ch, a cyberattack targeting an external software provider led to the theft of personal data from the City of Zurich pension fund. The Swiss Post pension fund says it was also affected by this attack, though it does not yet know whether its policyholders’ data has been compromised. On the same day, the online magazine Republik announced a theft of user data through a different route: a poorly protected analytics tool.

How the attack reached the pension funds

The mechanism is that of a supply chain attack: it was not the funds’ own systems that were breached in the first place, but those of a software supplier they work with. According to the City of Zurich, the attack took place at the end of September. In preparation for the switch to a new management system, the fund’s data had previously been transferred to this provider.

The Zurich fund has filed a criminal complaint and is trying to establish exactly what information was stolen and how many people are affected. The City states that the fund and pension payments remain operational. The administrative system used to manage assets and pay pensions is reportedly not affected, according to the information released.

The case is not an isolated one. Last week, it emerged that data had also been stolen from the Bernese Pension Fund and the Bernese Teachers’ Insurance Fund, likewise via an external software supplier, according to swissinfo.ch.

What data is involved

For the City of Zurich fund, the worst-case scenario includes personal contact details (name, address, email, phone number), social security number, marital status, information about partners, IBAN number and pension data such as insured income and retirement savings.

On the Swiss Post side, the pension fund states in a press release that pension assets and pension benefits are not at risk. It acknowledges, however, that data such as name, address, date of birth, social security number, contact details, email address and pension information may have been affected.

The sources consulted do not detail the steps recommended to policyholders. It is therefore up to the funds to inform those affected once the analysis is complete. Our analysis: the combination of contact details, an IBAN and pension data is the kind of information that can make a fraudulent message more credible, which warrants particular attention to any unusual requests claiming to come from a pension fund.

Republik: a known but unpatched vulnerability

The Republik case, reported by Keystone-SDA on the same day, involves a different scenario, even though it shares one thing in common: dependence on a third-party tool. Unknown attackers exploited a security vulnerability in Metabase, an analytics tool. According to the magazine, unauthorised access had been ongoing since August. “The security vulnerability had been known since August 6, but we did not take the necessary countermeasures in time,” Republik admits.

The magazine does not know who is behind the attack. Many indications point to a broad, automated wave of attacks targeting all Metabase installations in search of credentials and keys for resellable AI services. There is no indication at this stage that Republik was specifically targeted. The data of active publishers, subscribers, newsletter recipients and all former users was nonetheless accessed: email addresses, names and, where applicable, phone numbers, year of birth and gender. No credit card data was leaked, according to the magazine, which reported the incident to the Federal Data Protection and Information Commissioner.

SME cybersecurity: what the NCSC points out

These incidents echo an interview published by PME with Roman Hüssy, co-head of GovCERT at the Federal Office for Cybersecurity (NCSC). According to the magazine, one third of Swiss SMEs have already suffered a cyberattack. “In Switzerland, incident management is the responsibility of the affected organisation itself; the NCSC acts in a subsidiary capacity,” explains Roman Hüssy. GovCERT works, in his words, “like a fire brigade” that provides first aid and an initial technical assessment.

The process is described as follows: the affected organisation contacts the NCSC via a form or the 24h/24 on-call line, then the incident is classified according to a four-level model, from “low” to “critical”. Operators of critical infrastructure, for their part, are subject to a legal obligation to report any incident to the NCSC without delay. The office has no power to issue directives: the choice between forensic analysis and immediate mitigation rests with the company.

Roman Hüssy highlights two common mistakes: partial implementation of recommendations, which lets attackers spread, and outdated contact details, which slow down alerts. The Republik case illustrates the first point: a known vulnerability, but one dealt with too late. For an SME, the lesson from these cases is concrete: know which providers hold its data, keep its emergency contacts up to date and apply recommended patches all the way through.

Sources