BERN - Publica, one of the largest pension funds in Switzerland, said on Thursday that data had leaked following a cyberattack on an external software supplier. Which data was affected, and how much of it, is still being established together with the federal authorities, the fund said in a statement.
The supplier detected the attack at the end of September and filed a criminal complaint. It also informed the relevant federal authorities, Publica and its other customers at the time. The Office of the Attorney General has since opened an investigation. Publica did not name the supplier or describe the nature of the leaked data, and said other federal agencies have no business relationship with the company in question.
Policyholders informed, scale still unclear
Publica said it has informed the people it insures about the breach, its potential consequences and the measures taken so far. At the end of 2025 the fund counted around 70,000 active members and 41,600 pensioners, with total assets of just under CHF 45 billion. Among those it covers are employees of the federal administration and of the federal institutes of technology domain.
The case lands in a difficult season for Swiss public IT. Only last week the state-owned aerospace supplier Beyond Gravity disclosed a targeted intrusion whose first traces dated from mid-August, and which became public only after forensic work allowed it. Once again it was not the institution's own walls that gave way, but a contractor's.
What happens now
The criminal investigation sits with the Office of the Attorney General, which does not comment on ongoing proceedings as a matter of routine. For the insured, the practical advice is the familiar one after any data leak: be sceptical of unexpected letters, calls or mails that quote personal details, and report anything suspicious. Publica has set up information channels for policyholders and says it will communicate further findings as the investigation with the federal authorities progresses.