The pension fund of the City of Zug (Pensionskasse der Stadt Zug) says that data on its insured members may be among the data stolen in the cyberattack on PK Softech, a Reinach-based software provider to several Swiss pension funds. According to its statement, reported on 9 November 2026 by the specialist website Inside IT, the link runs through Libera, the consulting firm to which it has entrusted its administration.

What the Zug pension fund announced

The facts reported by Inside IT come down to a few points. The attack on PK Softech dates from late September 2026. The Zug fund says it was first informed of it in mid-October 2026.

On the basis of the information available at the time, it believed it had been spared, it explains. Only during the week of 2 November 2026 did it learn that data on its insured members could be affected. It says it immediately took the necessary measures.

According to the fund, PK Softech held the following data on its insured members:

  • name, date of birth and address;
  • OASI number (old-age and survivors' insurance);
  • salary data;
  • in some cases, telephone number and email address.

The fund reported the incident to the Federal Data Protection and Information Commissioner (FDPIC) and informed its insured members. It states that retirement assets are safe. Again according to the fund, no particularly sensitive data, such as records of incapacity for work or disability, has been affected.

A chain of outsourcing: pension fund, administrator, software

The Zug case shows how pension data ends up with a provider the insured person does not know. The fund outsourced its administration to Libera. Libera, in turn, uses PK Softech's software. It was with the latter that the insured members' data was stored, according to the fund.

Another case followed by 2clics illustrates a variant of the same pattern. On 16 October 2026, the City of Zurich explained that its pension fund's data had been transferred to a software provider in preparation for the switch to a new management system. The theft took place there, and not in the fund's own systems. At the time we reported on the cyberattack targeting the Zurich and Swiss Post pension funds, without being able to say whether that provider was PK Softech. Inside IT now lists the pension fund of the City of Zurich among the funds that use this software.

Our analysis: the more links there are in the chain, the more slowly information travels. In Zug, several weeks separated the first notification, in mid-October, from the announcement of possible exposure.

PK Softech: which pension funds are investigating

According to Inside IT, several funds that use PK Softech's software opened investigations into possible leaks shortly after the attack. They include the Federal Pension Fund Publica, the Bernese Pension Fund, the Migros pension fund, the Swiss Post pension fund, the Syngenta pension fund and the pension fund of the City of Zurich.

Opening an investigation does not mean being affected. The case of the data leak at Publica is established, as is that of two Bernese pension funds: the Bernese Pension Fund and the Bernese Teachers' Insurance Fund. The data reported varies from one fund to another.

FundData cited as possibly affectedWhat the fund says about assets
City of ZugName, date of birth, address, OASI number, salary, sometimes telephone and emailRetirement assets safe
City of Zurich (worst-case scenario)Name, address, email, telephone, OASI number, marital status, partners, IBAN, insured income, assetsFund and pension payments operating normally
Swiss PostName, address, date of birth, OASI number, contact details, email, pension informationPension assets and pensions not at risk

Sources: statement by the Zug fund reported by Inside IT; communications from the City of Zurich and the Swiss Post pension fund reported by 2clics on 16 October 2026.

What the data protection act provides

The Federal Act on Data Protection (FADP) governs the reporting of this type of incident in its Article 24. The controller must report to the FDPIC "as soon as possible" any data security breach that is likely to result in a high risk for the data subjects.

The same article directly addresses outsourcing. The processor must report "as soon as possible" any breach to the controller, regardless of its severity. The controller then informs the data subjects where this is necessary for their protection, or where the FDPIC requires it.

The Commissioner, for his part, has already taken up the matter. PK Softech reported the attack to him on 8 October 2026. He opened an informal preliminary investigation at Publica on 14 October, then a formal investigation against PK Softech on 23 October 2026. He wants to establish which data the funds had entrusted to the company, on what legal basis, and what was stolen.

What an insured person or an affiliated SME can do

An insured person can ask their pension fund what data it processes about them. Article 25 FADP gives them this right of access. The information is provided free of charge and, as a rule, within 30 days. It includes, in particular, the recipients to whom the data has been disclosed.

A useful point in this case: according to the same article, a controller that has data processed by a processor remains obliged to respond. The insured person therefore contacts their pension fund, without having to identify Libera or PK Softech themselves.

Our analysis: identity data combined with salary or IBAN details can make a fraudulent message more credible. An unexpected email, text message or call claiming to come from a pension fund therefore deserves to be checked through a known channel.

For an affiliated SME, the salaries submitted for its employees are among the data cited in Zug. As 2clics noted on 16 October 2026, the lesson is a practical one: know which providers hold your data. The Commissioner himself raises the question of the legal framework for these transfers and how it is applied in practice.

What we do not yet know

  • How many insured members of the Zug fund are affected, and whether their data was actually stolen: the fund speaks of data that "could" be affected.
  • How many pension funds in total have insured members affected by the attack on PK Softech.
  • The findings of the FDPIC investigation and their timetable, which the Commissioner has not disclosed.

Sources