Hacker Attack on IT Service Provider Widens Its Reach
Last Thursday, the federal pension fund Publica informed the public about a data breach caused by a hacker attack on IT service provider PK Softech. Since then, however, the number of affected companies has grown.
Meanwhile, the Migros pension fund and the pension fund of the City of Zurich (PKZH) have also reported data breaches. It remains unclear which data, and how much, has been leaked.
“According to current knowledge, personal data of insured persons at the pension fund of the City of Zurich (PKZH) were stolen in the cyberattack on software provider PK Softech AG,” according to a statement on Friday. “Pension assets and pensions are not at risk.”
The system used to manage PKZH assets and pay out pensions was not affected. PKZH will inform all insured persons who may be affected and advises them to remain especially vigilant against fraud attempts.
PKZH plans to switch to PK Softech’s administration system at the beginning of 2027. Data had been transmitted to the company in preparation for this transition.
The fund said it deeply regretted that data belonging to its insured persons had fallen into the wrong hands and that PKZH had filed a criminal complaint.
Investigations Underway
Which data was actually stolen is currently under investigation. In the worst case, the following information may be affected: name, first name, date of birth, AHV number, address, email addresses and telephone numbers (business and private), pension data such as insured salary and pension assets, marital status, information on the partner, as well as IBAN.
PKZH recommends not opening links or attachments in unexpected emails, SMS messages or chats, and not sharing login credentials or bank details.
Other clients of PK Softech include the Migros pension fund, the pension fund of the Post, the Bernese pension fund (BPK) and the Bernese teachers’ insurance fund (BLVK). According to the Canton of Bern, there are currently no indications that data from the two pension funds has been stolen. However, this cannot be completely ruled out.
