Summary
- Environment: PK Softech infrastructure holding pension-fund data, including migration and test data
- Operational impact: Vendor environment isolated; pension payments and fund production systems reported unaffected
- Financial impact: No verified loss total in the reviewed evidence
- Record status: Developing record. Reviewed October 25, 2026; updated as evidence emerges.
What happened
PK Softech, a Swiss pension-software supplier, reported that unknown attackers used malware to enter part of its infrastructure in late September 2026. It isolated the affected environment and said data must be assumed to have left its systems. [5]
In its October 23 announcement, the Federal Data Protection and Information Commissioner (FDPIC) said data had been extracted from several pension funds, including Publica. The regulator opened a formal investigation into PK Softech on October 22. [1]
Impact
Pensionskasse Stadt Zürich (PKZH) said its members’ and pensioners’ personal data were stolen from the supplier. It had provided data for migration tests before a planned system change in early 2027. Its current pension administration system was not attacked. [2]
Publica and PKZH identified potentially involved names, dates of birth, Swiss social-insurance numbers, contact details, salary and pension information, marital and partner details, and bank-account identifiers. Both continued investigating the exact individuals and fields affected; the reviewed evidence does not establish an affected-person total. [2][6]
Publica said its own production pension system was separate from the vendor’s test environment. Publica, PKZH and Bernische Pensionskasse (BPK) reported that pension payments and assets were unaffected. BPK’s October 20 notice still could not confirm whether its own members’ data had been taken. [2][3][6]
Timeline
Vendor reports customer service restored
PK Softech said it was again available to customers without restriction from October 2, after isolating the affected environment.
[5]Public notice and regulatory report
The vendor’s news index dates its incident notice to October 8. The FDPIC said it received PK Softech’s report that day.
[1][4]Preliminary regulatory inquiries begin
The regulator began informal preliminary inquiries with Publica.
[1]BPK files criminal complaint
BPK filed a complaint while continuing to investigate whether its members’ data were involved.
[3]Formal investigation opened
The FDPIC opened a formal investigation into PK Softech, announced publicly on October 23.
[1]Briefing updated
This briefing was last reviewed and updated on October 25, 2026.
Threat Group & Attack Vector
The vendor’s incident notice describes malware-assisted access to its infrastructure. It does not identify the initial entry route, a specific exploit or a malware family. [5]
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- No specific MITRE ATT&CK technique is currently mapped for this case.
Response
PK Softech engaged external specialists, notified customers and authorities, and filed a criminal complaint. PKZH also filed a complaint and continued notifying members. [2][5]
The FDPIC is examining what pension data were transferred to the supplier, the legal basis and handling of those transfers, and the extent of the theft. Its investigation concerns suspected violations; the announcement is not a completed finding of liability. [1]
Publica’s ongoing incident page retains its October 20 uncertainty about whose data were stolen, while the later regulator statement identifies Publica among the affected funds. Publica also said its October 21 website interruption was precautionary vulnerability patching unrelated to this attack. [1][6]