The Federal Data Protection and Information Commissioner (FDPIC) opened a formal investigation into PK Softech on 23 October 2026. This software provider works for several Swiss pension funds, including the Federal Pension Fund Publica. Following the cyberattack that hit its IT infrastructure, the Commissioner wants to know what data the funds had entrusted to it and what was stolen.

What the Commissioner announced on 24 October 2026

The investigation targets the company directly, because there are indications of a possible breach of data protection rules. This is stated in a press release from the Commissioner published on 24 October 2026, reported by the Keystone-SDA news agency and SWI swissinfo.ch.

PK Softech had itself reported the attack to the Commissioner on 8 October 2026. At the time, it referred to an attack on its IT infrastructure and possible data security breaches. The Commissioner had first opened an informal preliminary investigation at Publica on 14 October.

DateStep
8 October 2026PK Softech informs the Commissioner of the cyberattack
14 October 2026Informal preliminary investigation at Publica
23 October 2026Formal investigation opened against PK Softech
24 October 2026Press release from the Commissioner

Which pension funds are affected?

During the cyberattack, data belonging to several pension funds that are clients of PK Softech was stolen. Publica is among them, as has been known for several days, and 2clics had already reported on the data leak at Publica.

Two Bernese institutions are also affected: the Bernese Pension Fund (BPK) and the Bernese Teachers' Insurance Fund (BLVK). Their case was covered in an article on two Bernese pension funds. According to swissinfo.ch, the affected funds have filed criminal complaints.

On 16 October 2026, 2clics reported that an attack on an external software provider had also made it possible to steal data from the pension fund of the City of Zurich. Swiss Post's pension fund also said it was affected, without knowing whether its insured members' data had been compromised. The sources consulted do not say whether this provider is PK Softech.

Preliminary investigation or formal investigation: what is the difference?

The Commissioner proceeded in two stages, with two different targets. The preliminary investigation of 14 October was informal and concerned a client fund, Publica. The formal investigation of 23 October targets the provider itself, PK Softech.

According to the press release, a formal investigation is directed against the company when there are indications of a possible breach of data protection rules. The Commissioner expects it to provide an overview of three points:

  • the personal data that the pension funds had made available to PK Softech;
  • the legal framework for these data transfers and how it was applied in practice;
  • the extent of the information stolen.

Our analysis: by working back from the client fund to its supplier, the Commissioner is looking at the entire data processing chain. The question is not only who was attacked, but also what had been passed on, and on what basis.

What the cyberattack means for 2nd pillar insured members

For now, no source says exactly which data was stolen from PK Softech. That is precisely what the Commissioner's investigation is meant to establish. Insured members of Publica, BPK and BLVK therefore do not yet have a clear answer.

The Zurich case gives an idea of what a fund may entrust to a software provider. In the worst-case scenario, the City of Zurich's pension fund listed:

  • name, address, email and telephone number;
  • social security number and marital status;
  • information on partners and IBAN number;
  • pension data, such as insured salary and retirement assets.

Pensions, for their part, did not appear to be at risk in the cases reported on 16 October. The City of Zurich said that its fund and pension payments remained operational. Swiss Post's pension fund stated that pension assets and pension benefits were not at risk.

The sources do not detail any steps recommended to insured members. It is up to the funds to inform those affected once their analysis is complete. Our analysis: contact details combined with an IBAN and pension data can make a fraudulent message more credible. An unusual request claiming to come from a pension fund therefore deserves particular attention.

For an SME that entrusts data to a provider, the case is a reminder of a question raised by the Commissioner himself: what legal framework governs this transfer, and is it actually applied?

What we do not know yet

  • The number of insured members affected and the exact type of data stolen from PK Softech.
  • The full list of client pension funds affected, beyond Publica, BPK and BLVK.
  • Any link between PK Softech and the attacks reported by the pension funds of the City of Zurich and Swiss Post.
  • The perpetrator of the attack: the sources consulted do not identify them.
  • The duration of the investigation and its possible consequences: the press release does not specify them.

Sources