Breaches

Swiss regulator probes pension software firm PK Softech after breach

Swiss FDPIC opens formal probe into PK Softech after pension member data stolen. What it means for UK schemes and their administrators.

Illustration of scales of justice over pension records, representing the Swiss regulator's investigation into PK Softech

Switzerland’s data protection regulator is formally investigating PK Softech AG, the pension administration software supplier whose breach exposed member data from several large Swiss pension funds, including the federal scheme Publica. For UK trustees and administrators, it shows how much depends on a single software supplier, and why oversight of processors has to happen before an incident.

What happened

The Federal Data Protection and Information Commissioner (FDPIC) said on 23 October 2026 that it had opened a formal investigation into PK Softech AG the previous day. The company, based in Reinach, builds software that Swiss occupational (second-pillar) pension funds use to run member records. It told the regulator on 8 October that attackers had got into its IT infrastructure and that data security might have been breached.

Three funds have been publicly named as affected: Publica, which is the pension fund for the Swiss federal administration, plus two Bernese schemes: the Bernese Pension Fund (BPK) and the Bernese Teachers’ Insurance Fund (BLVK). The affected funds also reported the incident to the regulator. On 14 October the FDPIC opened informal preliminary enquiries with Publica before moving to formal proceedings against the supplier itself.

According to the regulator, the investigation will establish three things: what personal data the funds handed to PK Softech, the legal basis for those transfers and how they worked in practice, and how much information was taken. The FDPIC said it could not comment further while proceedings are open. Swiss broadcaster SRF reported that the Office of the Attorney General has opened a criminal investigation, and PK Softech says it has filed a criminal complaint.

The detail

PK Softech was not the target in the sense that most headlines mean. Attackers broke into the supplier and appear to have reached client data through it. In a statement reported by Swiss finance site Inside Paradeplatz, the company said unknown parties had used malware to get into part of its infrastructure, that it had disconnected the affected environment and brought in outside specialists, and that it had to assume data had left its systems.

The data involved is sensitive. Publica told members, in a notice seen by SRF, that the exposed records may include names, addresses, Swiss social security (AHV) numbers, salaries, insured earnings, pension balances and details of spouses or partners. Publica says the pension assets themselves are safe and that payments continue as normal. It has about 66,000 active members and around 40,000 pensioners, and it is not yet clear whether all of them or only some are affected. Beatrice Rychen, Publica’s head of communications, told SRF: “For us, it is the worst thing that can happen.”

The full list of affected schemes is still unclear. Inside Paradeplatz has reported that other large Swiss employers’ pension funds use PK Softech software, but those funds have not confirmed it and I have not counted them. No group has publicly claimed the attack, and beyond the company’s reference to malware, nobody has said how the attackers got in.

The incident has an uncomfortable precedent. SRF points out that in 2023 attackers stole Swiss federal data through another software supplier, Xplain. Afterwards the Federal Council brought in extra security requirements for working with IT suppliers. It is not yet clear whether those rules reached a pension fund’s software supplier such as PK Softech.

Timeline of the PK Softech breach from notification of the regulator on 8 October to the FDPIC announcement on 23 October 2026

Why it matters for UK organisations

UK occupational pension schemes rely heavily on outsourced administrators and on a small number of administration platforms. Trustees are usually the data controllers. The administrator or software house is usually a processor, and sometimes a joint controller. Under UK GDPR the controller still answers for the security of the data, even when it is hosted or processed elsewhere. If a supplier fails, the regulator will ask what the scheme did to check that supplier before the breach, not only how the supplier responded afterwards.

The Capita incident is the obvious UK comparison. In October 2025 the ICO fined Capita plc and Capita Pension Solutions a combined £14m over the March 2023 attack, in which data on 6.6 million people was stolen. Capita Pension Solutions processes data for more than 600 organisations that run pension schemes, and 325 of them were affected. Pensions Expert reported that around 470,000 Universities Superannuation Scheme members were among them. Among the regulator’s recommendations was a reminder to check the agreements and responsibilities between controllers and processors, which is the same question the Swiss regulator is now asking.

The data at stake is also exactly what fraudsters want. A record that combines a national identifier, salary, pension value and partner details is ideal for impersonation, social engineering and targeted pension scams. UK members are already heavily targeted by pension transfer fraud, and a leak like this makes those approaches far more convincing.

Expert view

When we assess supplier estates, the pension administration platform is often one of the least scrutinised systems in the organisation, despite holding some of the most sensitive data. Assurance often amounts to an annual questionnaire and a certificate. That is not enough when one vendor holds the records of hundreds of thousands of people across several schemes.

The way the Swiss regulator has framed the investigation is telling. It is not only asking how the attackers got in. It wants to know what data the funds passed to the supplier and on what legal basis. In my experience, that is where many organisations struggle. Suppliers often hold far more history than they need: old test extracts, support copies of production databases and records for members who left long ago. Every one of those adds to the damage when a supplier is breached.

The Capita findings also apply here. The ICO criticised slow responses to alerts, a lack of tiering for administrative accounts and penetration testing that happened only when systems were first commissioned. None of that is fixed by a contract clause.

What to do now

  1. Map your pension data flows. List every administrator, platform and sub-processor that holds member data. Record what fields they receive and how long they keep them.
  2. Minimise what suppliers hold. Stop sending national insurance numbers, bank details or partner information unless the service needs them. Ask for test and support copies to be deleted.
  3. Review processor contracts. Check the Article 28 terms on security, breach notification deadlines, audit rights and sub-processor approval, and use those rights.
  4. Ask for evidence, not assurances. Ask key suppliers for current Cyber Essentials Plus certification as a baseline, recent independent penetration test summaries and evidence of how they control privileged access.
  5. Rehearse a supplier breach. Run a tabletop exercise in which your administrator is compromised. Agree who decides on ICO notification within 72 hours, who writes to members and who briefs trustees.
  6. Prepare member fraud warnings. Have template messages ready that warn members about calls and emails claiming to come from the scheme, and offer a verified contact route.

Bottom line

The Swiss investigation focuses on PK Softech, but the questions it asks apply just as much to every UK pension scheme. Know what you have handed to your suppliers, keep it to the minimum, and test their security before an attacker does.

Sources

Related Posts