ZURICH - The City of Zurich pension fund is warning its members to be careful with unexpected letters, mails and phone calls after hackers breached one of its IT suppliers. The attack on PK Softech AG took place in late September, and investigators are still working to establish the exact scope of the theft.
The fund, known by its German initials PKZH, said the analysis continues but that the worst case must be assumed: a comprehensive set of personal data could have been copied. A criminal complaint has been filed, and the authorities have opened an investigation.
AHV numbers and IBANs among the data
The list of possibly compromised information is long. It includes names, dates of birth, home addresses, civil status and details about spouses or partners. More critically, the hackers may also hold AHV numbers, bank account details in the form of IBANs, and pension data such as insured salaries and current pension balances. Private and professional email addresses and phone numbers are considered at risk as well.
The fund stressed one point with emphasis: pension savings and regular payouts remain completely secure. The breach did not touch the live administration system. It happened on the platform of PK Softech AG, an external provider whose software the fund is testing ahead of a planned system migration in early 2027. Only the records in that test environment were exposed.
A familiar pattern
The case fits a run of attacks on third-party suppliers holding sensitive Swiss data. This month the federal pension fund Publica disclosed a data breach after a cyberattack on one of its own suppliers, and the state-owned space supplier Beyond Gravity reported a targeted attack that investigators linked to China. On Wednesday, the media outlet Republik said hackers had stolen its subscriber records.
The PKZH's advice to insured members is practical: treat unexpected communications that quote personal details with suspicion, do not open links or attachments from unknown senders, and verify directly with the fund when in doubt. Scammers are quick to turn stolen identity data into convincing phishing attempts, often within days of a breach becoming known.