Swiss data breaches rise as pension-fund cyberattack comes under investigation

455 incidents have been recorded so far this year, already above the 343 reported during all of 2025. The figures, reported by Federal Data Protection and Information Commissioner Adrian Lobsiger in an interview with Sonntagsblick, put Switzerland’s data-security workload in sharp focus as the year continues.

Lobsiger cautioned that the recorded total is likely to understate the scale of the problem. Many incidents go unreported, he said, meaning the official count captures only cases brought to the commissioner’s attention. The figures cover security incidents broadly; the reporting does not identify how many involve cyberattacks or how many affect personal data.

The rise comes as the commissioner examines a cyberattack on PK Softech, a software provider used by several Swiss pension funds. The formal inquiry is aimed at establishing what personal data the funds shared with the company, how those transfers were governed and what information was stolen. That investigation connects the national incident tally to a concrete concern for pension institutions: protecting sensitive records handled through shared technology services.

The commissioner’s formal investigation is focused on PK Softech, after the company reported a cyberattack on its IT infrastructure on October 8. The attack involved the theft of data from several pension funds that used the provider’s software. The commissioner said an investigation is directed at a company when there are indications of a possible breach of data-protection rules.

The inquiry followed an informal preliminary investigation at Publica, which began on October 14. On October 23, the commissioner opened the formal case against PK Softech. The pension funds concerned have also lodged complaints over the incident.

The commissioner expects the investigation to establish what personal data the funds made available to the software company, the legal framework for those transfers and how that framework operated in practice. Investigators are also examining the extent of the stolen information. Lobsiger said the proceedings could later extend to federal bodies and pension funds. He declined to discuss case-specific details in the interview, citing the confidentiality of the investigation.

Publica, the Bernese Pension Fund and the Bernese Teachers’ Insurance Fund are among the organisations affected. The attack has brought the data arrangements between pension funds and their software provider under scrutiny, as the commissioner seeks a full picture of the personal information shared and the data stolen.

The commissioner has warned that connecting data and dismantling data silos can raise the risk of security breaches. Integrated systems can involve information moving between organisations and services, making it important to control what is passed along. Lobsiger said only data that is strictly necessary should be transmitted.

He also recommended using anonymised test data wherever possible. That approach limits the exposure of identifiable personal information during testing, while keeping the focus on the essential data-protection questions in the PK Softech case: what information was transferred, on what legal basis and how those transfers were carried out. The inquiry’s findings are expected to clarify the data flows between the affected funds and the provider.