Publica data leak: what the supplier notices confirm

Publica, the Swiss Federal Pension Fund, confirmed a data leak in an October 8, 2026 statement following an attack on an external software supplier. The fund says investigators are still establishing which of its data were affected.¹

Too long; didn’t read?

• Publica says the supplier discovered the attack in late September.¹
• Software provider PK Softech separately says data are believed to have left its systems.²
• The published statements do not establish a final affected-person count or a complete list of exposed information.^{1, 2}

A disclosure this week, an attack last month

In its announcement, Publica says the supplier filed a criminal complaint and informed the fund, relevant federal authorities and other customers. Publica also says Switzerland’s Office of the Attorney General has opened an investigation, and that members have been informed about the leak and the action taken.¹

An October 8 Swiss news agency report published by laRegione identifies the supplier as PK Softech.⁴ PK Softech’s own statement describes an attack in late September 2026. According to the company, unknown attackers used malicious software to reach part of its IT infrastructure. It says it disconnected the affected environment, brought in outside specialists, notified the authorities and filed a criminal complaint.²

The supplier says its services have been fully available to customers again since October 2. Its statement expresses regret and says it is working with customers and the authorities to investigate the incident.²

What the notices leave unresolved

Publica’s announcement does not name the supplier. PK Softech’s separate statement does not name individual customers. Neither statement provides a final list of exposed data fields or an affected-person total; both describe continuing work to establish the scope.^{1, 2}

For members, the unanswered question is which of their records were involved. Both organisations say work to establish the scope is continuing.^{1, 2}

Check the message before acting on it

As general breach guidance, the UK’s National Cyber Security Centre warns that criminals can use stolen details to make messages look convincing. It also warns that publicity around a breach can attract scam messages even when a recipient’s details were not stolen.³

The centre recommends checking your situation through the organisation’s official website, rather than using contact details or links supplied in an unexpected message. For Publica members, start with the fund’s own published information and ask which records concern you.³

Keep any genuine notification for reference. Treat an urgent request to reset an account, claim compensation or hand over personal details as a reason to pause and verify it independently; these are warning signs described in the NCSC’s guidance.³

Reporting checked October 8, 2026. The cover is an original generated illustration, not a photograph of the incident.

Sources

1. Publica: supplier cyberattack and confirmed data leak (German; listed October 8, 2026).
2. PK Softech: statement on the attack and response (German; accessed October 8, 2026).
3. UK NCSC: data-breach guidance for individuals and families (general guidance).
4. laRegione / ATS: PK Softech’s response to the Publica data theft (October 8, 2026; Italian).