Summary

• The FDPIC opened a formal investigation into PK Softech on 22 October following a cyberattack discovered in September.
• Affected institutions include the federal pension fund Publica and the City of Zurich pension fund, whose migration to the supplier was still in preparation.
• Investigators are examining the information transferred to the supplier, the legal arrangements governing it and the extent of the breach.

Switzerland’s privacy regulator has opened a formal investigation into pension software supplier PK Softech after attackers extracted information associated with several major pension funds, including records supplied by an institution preparing to migrate to the company’s systems.

The Federal Data Protection and Information Commissioner (FDPIC) announced on 23 October that proceedings against PK Softech had formally begun the previous day. The regulator will examine the personal information transferred by pension institutions, the legal arrangements governing those transfers and the extent of the data removed during the attack.

PK Softech notified the authority on 8 October following an intrusion into its IT infrastructure discovered in late September. The FDPIC opened an informal preliminary inquiry involving the federal pension fund Publica on 14 October before extending its examination to the supplier itself.

Although multiple institutions have acknowledged potential exposure, the information available so far does not establish a comprehensive total of affected individuals or confirm which records were extracted for every pension fund. The formal investigation concerns suspected breaches of data protection obligations, not a completed finding that the software company violated the law.

A migration project caught in the breach

The City of Zurich pension fund, PKZH, has provided a particularly revealing account of its exposure. The institution currently uses software from another provider and had planned to migrate to PK Softech’s administration system at the beginning of 2027.

To prepare for that transition, PKZH supplied information for testing whether records could be transferred completely and accurately. Following the cyberattack, preliminary inquiries indicated that personal data belonging to its insured members had also been taken from the supplier’s systems.

The pension fund emphasises that its current administration platform was not affected. Pension assets remain secure, and payments continue normally, although its investigations into the information held by PK Softech are continuing.

The distinction demonstrates how sensitive records can become exposed before a new system enters production. Technology migrations commonly involve converting existing records, testing calculations and comparing the results produced by old and new applications. Those processes may require realistic datasets long before users begin working with the replacement software.

For pension administration, the information can include employment and financial details extending across many years. PKZH has identified potentially affected fields including names, birth dates, social insurance numbers, contact details, pension balances, insured earnings, marital information and bank account identifiers.

That list represents categories of information that may have been compromised, rather than a verified account of what was taken for each member. The institution is continuing its analysis and has advised members to remain alert to suspicious messages or requests for financial information.

PKZH says it put contractual confidentiality and data protection arrangements in place when supplying information for the planned migration. Whether PK Softech met the relevant obligations is among the matters requiring investigation.

Why pension information attracts criminals

Occupational pension systems contain records that can be useful to fraudsters even when an intrusion does not provide direct control over pension assets. Names, contact details, employment history and financial identifiers can be combined to make deceptive communications appear credible.

An attacker possessing such information might impersonate a pension provider, employer or financial institution and attempt to persuade an individual to disclose further details. The existence of an IBAN or social insurance number does not, by itself, give someone the authority to withdraw pension savings.

PKZH has stressed that payments and changes to banking arrangements are subject to additional verification. Nevertheless, the possible exposure of personal information creates a separate risk of impersonation, phishing and other forms of fraud.

Publica and other affected institutions must examine their own records and determine what information was held by the supplier. The implications may vary according to the services each institution used and the data it transferred.

That variation complicates the regulator’s task. A supplier serving several pension funds may hold similar types of information under different contractual arrangements, with separate responsibilities for each client and different requirements concerning retention and access.

Even where the same cyberattack affects multiple organisations, their notification obligations and assessments of the likely impact on members may not be identical. The presence of an institution’s data in an affected environment also does not establish that every record was successfully extracted.

Responsibility across outsourced systems

Swiss pension institutions depend on specialist software to calculate benefits, manage contributions, maintain member records and support payments. Outsourcing those functions allows organisations to use established products without developing every component themselves, but it requires access to personal information that remains subject to legal protection.

The FDPIC intends to examine how that information was transferred and what safeguards governed its use. Contracts and documented responsibilities will be relevant, although investigators must also establish how arrangements operated in practice.

For example, a contract may specify that information is used only for an agreed purpose, while a technical assessment needs to determine which employees, applications and supporting systems could actually access it. Backup copies, test environments and migration records may hold sensitive material outside the principal production database.

The same considerations apply when suppliers appoint their own contractors. An institution should understand where its information is processed, how access is granted and which party is responsible for investigating an incident or deleting records that are no longer required.

During a migration, organisations must also decide how long test information should be retained and whether a less sensitive dataset could provide sufficiently reliable results. Realistic records can be necessary for validating complex calculations, but their use brings corresponding obligations concerning security and retention.

These questions are not unique to pension administration. Banks, insurers, healthcare providers and public authorities routinely transfer sensitive information during software replacements and integration projects. Those exchanges can create exposure outside the systems that ultimately enter service.

Separate investigations, unresolved impact

Swiss authorities have also opened criminal proceedings relating to the cyberattack. The criminal investigation concerns the incident and those responsible for it, whereas the FDPIC’s inquiry examines the supplier’s compliance with data protection requirements.

Neither investigation has yet produced a public account establishing the attacker’s identity, the full method of intrusion or the complete scope of information compromised across the affected pension funds.

For the institutions involved, technical recovery and member notification must proceed while investigators determine what happened. Pension funds need to preserve their operational services, assess whether records require additional protection and communicate credible information without treating uncertain exposure as a confirmed loss for every member.

The City of Zurich pension fund is also reviewing its planned software migration in light of the incident. That decision concerns the suitability and management of a future technology supplier, independently of whether its existing pension administration continues without interruption.

The FDPIC’s findings should provide further evidence about the way sensitive information passed between the pension funds and PK Softech. Until then, the central confirmed facts are the extraction of data, the involvement of several pension institutions and the regulator’s formal examination of the supplier’s handling of that information.