Short answer
The Swiss federal government confirmed on 8 October 2026 that data left the systems of an external software supplier to the federal pension fund Publica after a cyberattack in late September. Netzwoche reports the ransomware group Akira is behind it and that more than 100,000 current and former federal staff may be affected.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Publica (via supplier PK Softtech) |
|---|---|
| Incident type | Supply-chain compromise |
| Status | Confirmed by authorities |
| Sector | Pension fund / government |
| Country | Switzerland |
| Disclosed | 2026-10-08 |
| People or records affected | Over 100,000 current and former federal employees, according to Netzwoche (21 October update) |
What data was exposed
- Names and dates of birth
- AHV (social security) numbers
- Addresses, phone numbers and email addresses
- Salary information
- Pension savings details (reported)
- Bank details, marital status and children (some records, reported)
What happened
At the end of September 2026, an external software supplier to Publica, the pension fund for federal employees, was hit by a cyberattack. On 8 October the Swiss Federal Council confirmed that data had flowed out. The notice did not name the firm. Media, including Netzwoche and SRF, identified it as PK Softtech.
The supplier filed a criminal complaint straight away. It told federal bodies, Publica and its other clients. The Federal Prosecutor’s Office opened an investigation.
Who is affected
The first official notice gave no number. Netzwoche’s later update says the Federal Council and security services now assume data on practically all current and former federal and related employees has leaked, which it puts above 100,000 people. Reported groups include administrative staff, judges and intelligence employees. Treat those counts as press reporting rather than an official figure.
The data types listed above come from the Tages-Anzeiger as cited by Netzwoche, plus Publica’s own warning that salary, pension assets and contact details could be involved. SRF explained that suppliers can end up with real data when they host the software for clients or use live data to fix faults.
Response and fallout
Publica wrote to insured persons about the leak. Netzwoche says that letter did not mention Akira or a ransom demand. The government set up a task force over the risk to staff in covert roles, and the intelligence service is reported to have paused some foreign operations. Those points are single-source reports.
What this means for you
If you are or were on the federal payroll, expect calls about “better pension returns”. Zürich and Bern police specifically warn about fake advisers and brokers. Read our guides on investment scams and government impersonation scams, and follow what to do after a data breach. A separate Swiss case is Ricardo.
Advice from the police
The cantonal police advice is plain: do not trust anyone who knows your finances without verifying them, do not hand over more personal details, and do not accept pressure. If a caller cites your salary or pension savings, end the call and ring the provider back on a number you found yourself.
What is still unknown
Officials have not published a final count, the exact route the data took to the supplier, or whether the files have been released. See all cases in our breaches section.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Cold calls from fake financial advisers or brokers who know your salary or pension savings and offer better returns.
- Phishing messages that quote your AHV number, employer or address to look like Publica, your pension fund or a federal office.
- Identity theft attempts using your date of birth and AHV number.
- Blackmail or pressure calls aimed at staff in sensitive roles.
What to do if you are affected
- 01Be suspicious of any unsolicited adviser or broker who already knows your financial situation. Verify them through official contact details you look up yourself.
- 02Do not share further personal details and do not let callers rush you into a decision about your pension.
- 03Read the letter Publica sent to insured persons and keep it. Contact Publica through its published number if you have questions.
- 04Report fraud attempts to your cantonal police and to the Federal Office for Cybersecurity (BACS).
- 05Watch for unexpected credit, account or insurance applications in your name, and ask your bank about extra checks if you are worried.
Frequently asked questions
Is my pension money at risk after the Publica supplier attack?
According to Netzwoche, Publica said retirement savings are secure and pension payments continue. The risk is to your personal data, not your balance.
Was Publica itself hacked?
The attack hit PK Softtech, a software supplier, not Publica directly (SRF). The supplier held data for Publica, and the Bernese pension funds BPK and BLVK also say they are affected as clients of a pension software supplier.
Who is behind the attack?
Netzwoche reports the ransomware group Akira is demanding a ransom and threatening to publish or sell the data. This comes from Netzwoche alone, and the official 8 October notice does not name any group. Netzwoche says Publica's letter to insured persons did not mention Akira or a ransom.
Are the Bernese pension funds affected too?
The Bernese Pensionskasse (BPK) and the Bernese Teachers' Insurance Fund (BLVK) are also affected by an attack on a pension software supplier. The canton says it has no evidence their data was stolen, but a leak cannot be ruled out.
Has the stolen data been misused yet?
Zürich and Bern cantonal police told Netzwoche they had not recorded a case of misuse at the time of its 21 October update.
Sources
- Pensionskasse des Bundes: Datenabfluss bestätigt (Federal pension fund: data outflow confirmed), Swiss Federal Council (admin.ch), 2026-10-08
- Bundespensionskasse Publica meldet Datenabfluss (Federal pension fund Publica reports data outflow), Netzwoche, 2026-10-08
- Pensionskasse des Bundes: Wie konnten heikle Daten bei externer Softwarefirma landen? (How did sensitive data end up at an external software firm?), SRF, 2026-10-10
This post summarises public reporting as of 2026-10-30. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.