--- title: "PK Softech pension-fund data theft" description: "Malware-assisted access to PK Softech exposed Swiss pension-fund data and prompted a formal regulator investigation." incident_type: "Cybersecurity incident" status: "active" last_modified: "2026-10-25" canonical_url: "https://www.ally.security/incidents/pk-softech-pension-fund-data-theft-2026" markdown_url: "https://www.ally.security/incidents/pk-softech-pension-fund-data-theft-2026.md" stix_url: "https://www.ally.security/incidents/pk-softech-pension-fund-data-theft-2026/stix.json" --- # PK Softech pension-fund data theft An intrusion at the pension-software supplier exposed downstream member data while pension funds continued operating their own systems. Last modified Oct 25, 2026 · 6 sources ## Summary - **Environment:** PK Softech infrastructure holding pension-fund data, including migration and test data - **Operational impact:** Vendor environment isolated; pension payments and fund production systems reported unaffected - **Financial impact:** No verified loss total in the reviewed evidence ## What happened [PK Softech](https://www.pksoftech.ch/), a Swiss pension-software supplier, reported that unknown attackers used malware to enter part of its infrastructure in late September 2026. It isolated the affected environment and said data must be assumed to have left its systems. [5](#source-5) In its [October 23 announcement](https://www.edoeb.admin.ch/en/fdpic-launched-investigation-following-cyber-attack-on-software-supplier), the [Federal Data Protection and Information Commissioner](https://www.edoeb.admin.ch/en) (FDPIC) said data had been extracted from several pension funds, including [Publica](https://www.publica.ch/). The regulator opened a formal investigation into PK Softech on October 22. [1](#source-1) ## Impact [Pensionskasse Stadt Zürich](https://www.pkzh.ch/) (PKZH) said its members’ and pensioners’ personal data were stolen from the supplier. It had provided data for migration tests before a planned system change in early 2027. Its current pension administration system was not attacked. [2](#source-2) Publica and PKZH identified potentially involved names, dates of birth, Swiss social-insurance numbers, contact details, salary and pension information, marital and partner details, and bank-account identifiers. Both continued investigating the exact individuals and fields affected; the reviewed evidence does not establish an affected-person total. [2](#source-2) [6](#source-6) Publica said its own production pension system was separate from the vendor’s test environment. Publica, PKZH and [Bernische Pensionskasse](https://bpk.ch/) (BPK) reported that pension payments and assets were unaffected. BPK’s October 20 notice still could not confirm whether its own members’ data had been taken. [2](#source-2) [3](#source-3) [6](#source-6) ## Timeline ### October 2, 2026 — Vendor reports customer service restored PK Softech said it was again available to customers without restriction from October 2, after isolating the affected environment. [5](#source-5) ### October 8, 2026 — Public notice and regulatory report The vendor’s [news index](https://www.pksoftech.ch/de/aktuelles) dates its incident notice to October 8. The FDPIC said it received PK Softech’s report that day. [1](#source-1) [4](#source-4) ### October 14, 2026 — Preliminary regulatory inquiries begin The regulator began informal preliminary inquiries with Publica. [1](#source-1) ### October 19, 2026 — BPK files criminal complaint BPK filed a complaint while continuing to investigate whether its members’ data were involved. [3](#source-3) ### October 22, 2026 — Formal investigation opened The FDPIC opened a formal investigation into PK Softech, announced publicly on October 23. [1](#source-1) ### October 25, 2026 — Briefing updated This briefing was last reviewed and updated on October 25, 2026. ## Threat Group & Attack Vector The vendor’s [incident notice](https://www.pksoftech.ch/de/newsreader/Cyberangriff-auf-die-PKSoftechAG) describes malware-assisted access to its infrastructure. It does not identify the initial entry route, a specific exploit or a malware family. [5](#source-5) ### Actors - No threat actor group has been identified in the reviewed public evidence. ### TTPs - No specific MITRE ATT\&CK technique is currently mapped for this case. ## Response PK Softech engaged external specialists, notified customers and authorities, and filed a criminal complaint. PKZH also filed a complaint and continued notifying members. [2](#source-2) [5](#source-5) The FDPIC is examining what pension data were transferred to the supplier, the legal basis and handling of those transfers, and the extent of the theft. Its investigation concerns suspected violations; the announcement is not a completed finding of liability. [1](#source-1) Publica’s [ongoing incident page](https://www.publica.ch/de/cyberangriff-auf-softwarelieferanten) retains its October 20 uncertainty about whose data were stolen, while the later regulator statement identifies Publica among the affected funds. Publica also said its October 21 website interruption was precautionary vulnerability patching unrelated to this attack. [1](#source-1) [6](#source-6) ## Assets [Download the case-scoped STIX 2.1 bundle]() ## Sources Primary source records used to research this incident. ### FDPIC launched an investigation following a cyberattack on a software supplier official · Federal Data Protection and Information Commissioner · Oct 23, 2026 ### Cyberangriff PK Softech official · Pensionskasse Stadt Zürich · Oct 20, 2026 ### Cybervorfall official · Bernische Pensionskasse · Oct 15, 2026 ### Aktuelles — Cyberangriff auf die PK Softech AG official · PK Softech AG · Oct 8, 2026 ### Cyberangriff auf die PK Softech AG official · PK Softech AG · Oct 8, 2026 ### Cyberangriff auf Softwarelieferanten official · Publica · Oct 8, 2026
Evidence ledger Review the supporting structured claims. 1. **Occurred At · 100% confidence · current** FDPIC begins preliminary inquiries with Publica: 2026-10-14 2. **Occurred At · 100% confidence · current** Vendor publishes incident notice: 2026-10-08 3. **Resulted In · 100% confidence · current** PK Softech pension-fund data theft: PK Softech said data must be assumed to have left its systems, while the nature and precise extent remained under investigation. 4. **Resulted In · 100% confidence · current** PK Softech pension-fund data theft: PKZH said personal data of insured members and pensioners were stolen from PK Softech. The data had been supplied for migration tests ahead of a planned early-2027 system change; its current pension administration system was not attacked. 5. **Resulted In · 100% confidence · current** PK Softech pension-fund data theft: The FDPIC received PK Softech’s report on October 8, began informal preliminary inquiries with Publica on October 14, and opened a formal investigation into PK Softech on October 22. 6. **Resulted In · 100% confidence · current** PK Softech pension-fund data theft: The formal regulatory investigation concerns suspected data-protection violations and seeks to establish transferred data, the legal basis and implementation of those transfers, and the scope of the theft; it is not a completed finding of liability. 7. **Resulted In · 100% confidence · current** PK Softech pension-fund data theft: PK Softech reports customer service restored 8. **Resulted In · 100% confidence · current** PK Softech pension-fund data theft: BPK said pension payments, assets and operations were unaffected and that it filed a criminal complaint on October 19. 9. **Resulted In · 100% confidence · current** PK Softech pension-fund data theft: PKZH said it learned on October 13 that its members’ data might be affected, later confirmed that suspicion, and notified members. Exact individuals and fields remained under investigation. 10. **Affected Organization · 100% confidence · current** PK Softech pension-fund data theft: Publica 11. **Vendor Of · 100% confidence · current** PK Softech AG: Bernische Pensionskasse 12. **Occurred At · 100% confidence · current** Regulator publishes investigation announcement: 2026-10-23 13. **Resulted In · 100% confidence · current** PK Softech pension-fund data theft: FDPIC begins preliminary inquiries with Publica 14. **Resulted In · 100% confidence · current** PK Softech pension-fund data theft: PKZH listed potentially affected names, birth dates, AHV numbers, contact details, salary and pension balances, marital and partner information, and IBANs. It said pension assets and payments were safe and had filed a criminal complaint. 15. **Occurred At · 100% confidence · current** BPK files criminal complaint: 2026-10-19 16. **Resulted In · 100% confidence · current** PK Softech pension-fund data theft: PK Softech reported that unknown attackers used malware to access part of its IT infrastructure in late September 2026. The public notice does not give an exact attack or detection date. 17. **Resulted In · 100% confidence · current** PK Softech pension-fund data theft: Publica described its October 21 website interruption as precautionary vulnerability patching unrelated to the PK Softech cyberattack; it sent another member newsletter on October 22. 18. **Resulted In · 100% confidence · current** PK Softech pension-fund data theft: Vendor publishes incident notice 19. **Resulted In · 100% confidence · current** PK Softech pension-fund data theft: Publica said its production pension system and original data remained on its own infrastructure, separate from the vendor’s test environment; pension payments and assets were unaffected. 20. **Occurred At · 100% confidence · current** FDPIC opens formal investigation into PK Softech: 2026-10-22 21. **Resulted In · 100% confidence · current** PK Softech pension-fund data theft: BPK files criminal complaint 22. **Vendor Of · 100% confidence · current** PK Softech AG: Publica 23. **Disclosed At · 100% confidence · current** PK Softech pension-fund data theft: 2026-10-08 24. **Resulted In · 100% confidence · current** PK Softech pension-fund data theft: Regulator publishes investigation announcement 25. **Resulted In · 100% confidence · current** PK Softech pension-fund data theft: The FDPIC said data had been extracted from several pension funds, including Publica, during the attack on PK Softech. 26. **Occurred At · 100% confidence · current** PK Softech reports customer service restored: 2026-10-02 27. **Resulted In · 100% confidence · current** PK Softech pension-fund data theft: Publica identified potentially involved names, birth dates, AHV social-insurance numbers, contact details, pension and salary information, marital and partner information, and IBANs. The precise individual scope remained unresolved. 28. **Resulted In · 100% confidence · current** PK Softech pension-fund data theft: FDPIC opens formal investigation into PK Softech 29. **Resulted In · 100% confidence · current** PK Softech pension-fund data theft: BPK’s October 15 update corrected earlier supplier information: personal data must be assumed to have left PK Softech, but BPK could not confirm that its own members’ data were among them. That uncertainty remained in its October 20 update. 30. **Resulted In · 100% confidence · current** PK Softech pension-fund data theft: Publica’s October 20 update said whether data from its members had been stolen, and whose data, remained under review; it reported no indication of publication on the dark web. 31. **Affected Organization · 100% confidence · current** PK Softech pension-fund data theft: PK Softech AG 32. **Resulted In · 100% confidence · current** PK Softech pension-fund data theft: PK Softech disconnected the affected environment, engaged external specialists, informed authorities and filed a criminal complaint. It said unrestricted customer service had resumed on October 2. 33. **Affected Organization · 100% confidence · current** PK Softech pension-fund data theft: Pensionskasse Stadt Zürich