BERN - When the attack became public on 8 October, the administration spoke of a serious but contained incident at the federal pension fund Publica. Two weeks later the picture is darker. Research by Tages-Anzeiger and SonntagsBlick shows that the security authorities now work on the assumption that data on virtually everyone who works for the Confederation has been stolen. Among the victims are employees of the Federal Office of Police and the Federal Intelligence Service who work under cover identities, people whose safety depends on their real names never appearing next to their employer's.
Foreign intelligence services or criminal organisations could now identify and locate exactly those staff, the reports warn. The sitting Federal Council is not affected, but former federal councillors are, along with more than a hundred thousand current and former employees of the Confederation and of federally linked businesses.
What the attackers hold
The stolen records read like a personnel file: names, dates of birth, addresses, telephone numbers, email addresses, AHV numbers and salary data, in some cases bank details. Entries on civil status, spouses or partners, and sometimes even children are also said to be included. The federal security services expect the data to be used for fraud by text message, telephone and email, and staff have been warned to treat unexpected contact with suspicion.
The intruders from the Akira group reached the servers of PK Softech, a small IT company in the Basel agglomeration, in the night from 28 to 29 September. The same supplier sits behind the breach at the City of Zurich pension fund, which is warning its own members about phishing this week. The Federal Prosecutor's Office, fedpol and the National Cyber Security Centre had jointly warned about Akira a year ago, in October 2025.
The ransom and the task force
Akira is now demanding payment for the pension fund data and is threatening to publish or sell it if the Confederation does not pay. The government does not comment on ransom negotiations as a matter of principle, and Switzerland has no tradition of paying extortionists with public money. The State Secretariat for Security Policy has set up a task force to steer the response, coordinate the technical analysis and prepare for the possibility that the data surfaces anyway.
The political aftershocks are only starting. Parliament wants to know why a supplier trusted with the most sensitive personnel data in the country was a small firm in the Basel suburbs, and why the warning signs from earlier attacks on the same company did not lead to action. For the thousands of employees now checking their inboxes a second time, the answer that matters is simpler: assume the data is out there, and act accordingly.