Swiss regulator investigates pension software firm PK Softech after data theft

Swiss regulator investigates pension software firm PK Softech after data theft

23 October 2026: Switzerland's Federal Data Protection and Information Commissioner (FDPIC) has opened a formal investigation into PK Softech AG, a supplier of software to pension funds, after attackers took data belonging to several large second-pillar funds, among them Publica, the pension fund of the federal administration. The commissioner wants to establish what personal data the funds gave the software company, on what legal basis, and how much of it was compromised.

Not yet independently verified. Neither the FDPIC nor PK Softech has said how many funds or people are affected or what kinds of data were taken, and PK Softech says the type and scope of the data are still being established. We will update this when it can be confirmed, and remove this note.

How the incident unfolded

PK Softech, based in Reinach near Basel, says it was hit by a cyberattack at the end of September 2026, when unknown attackers used malware to get into part of its IT infrastructure despite what it calls high security standards. It disconnected the affected environment, brought in outside specialists, informed the authorities and filed a criminal complaint. "Nach heutigem Kenntnisstand muss davon ausgegangen werden, dass Daten aus unseren Systemen abgeflossen sind," the company says: on what it knows today, it must be assumed that data left its systems. It has been fully available to its customers again since 2 October.

The FDPIC's timeline begins on 8 October, when PK Softech reported the attack and possible breaches of data security. The affected pension funds then made their own reports. The commissioner began an informal preliminary investigation with Publica on 14 October and opened the formal investigation into PK Softech on 22 October.

What the investigation will look at

The FDPIC says it is investigating on suspicion of a breach of data protection rules, and gives two aims. The first is an overall picture of the personal data the affected funds made available to PK Softech. The second is to clarify the legal framework for those transfers and how they were carried out in practice, along with the extent of the information that was compromised. It will say nothing more while the proceedings are pending.

That framing reaches beyond the supplier. The commissioner is asking not only whether PK Softech protected the data, but what the funds sent it in the first place and on what terms, which puts the funds' own data transfers under review as well.

What funds using the software can do now

PK Softech says it has informed its customers and is working closely with them and the authorities, so a fund that uses its software should already have been contacted. The FDPIC's two questions are the ones such a fund will be asked: which member data it made available to PK Softech, and under what agreement. Funds that cannot yet answer the first, for instance because data was shared for support or migration work, have reason to establish it before the commissioner asks. The same applies to funds on any other administration platform.

Neither the FDPIC nor PK Softech has named the other affected funds, and the company refers media enquiries to a dedicated address on its site.

Company profile on TrustList: PK Softech AG

Sources

• FDPIC: FDPIC launched investigation following cyber attack on software supplier, 23 October 2026
• PK Softech AG: Cyberangriff auf die PK Softech AG (read 2026-10-23), 23 October 2026