Summary
- The FDPIC formally opened proceedings against PK Softech on 22 October, following an initial Publica inquiry.
- The investigation concerns personal information transferred by pension funds and the extent of data extracted during the attack.
- An investigation does not establish that the supplier breached data protection law.
Switzerland’s Federal Data Protection and Information Commissioner has opened a formal investigation into software supplier PK Softech AG after attackers extracted data associated with several occupational pension funds, including the federal pension fund Publica. The proceedings move the incident beyond the immediate question of what was stolen to the legal and operational arrangements under which pension providers entrusted information to a common technology supplier.
The regulator said on 23 October that PK Softech notified it of the cyberattack and possible data security breaches on 8 October. Several affected pension funds subsequently submitted their own notifications. An informal preliminary investigation concerning Publica began on 14 October, before the commissioner opened formal proceedings into PK Softech on 22 October.
Those dates mark separate steps in the response. The cyberattack and disclosure were already known earlier in October; the new development is the regulator’s examination of the supplier and the arrangements governing transfers from multiple pension institutions. Neither the opening of proceedings nor the fact that information was extracted determines whether PK Softech violated Swiss data protection requirements.
According to the commissioner, the inquiry will establish what personal information the affected funds made available to PK Softech, the legal framework for those transfers, how that framework was implemented in practice, and the extent of information compromised. The regulator has not published a final finding, a complete victim count, or a definitive inventory of records affected.
Occupational pension records can contain information used to administer employment-related entitlements, contributions and benefits. Information that passes between pension funds and their software provider may be operationally necessary for accurate recordkeeping, yet every additional transfer also establishes responsibilities for storage, access management, retention and incident handling. The commissioner is seeking to understand those arrangements rather than assuming that all customers shared identical data.
Shared suppliers create a particular problem during incident investigations. An institution can know that its service provider was attacked without immediately knowing which of its own records were present in a compromised environment, whether information was accessed or copied, and which individuals must be notified. Those answers depend on the supplier’s system architecture, logging, data inventory and ability to distinguish each customer’s records.
For the affected pension funds, the regulatory process may therefore run alongside technical recovery and communication with members. A reportable incident at a supplier can require customers to establish their own obligations, even when they did not operate the vulnerable system. They need accurate evidence from the supplier to assess exposure and determine which contractual and statutory responsibilities apply.
The commissioner’s statement distinguishes an informal inquiry involving Publica from the formal investigation into PK Softech. That distinction matters because a customer and a supplier occupy different positions in the processing chain. Pension institutions determine why member information is needed for pension administration, while a contracted software provider may process data under agreed arrangements. The precise allocation of responsibility is among the questions the regulator intends to clarify.
The new proceedings also test how promptly information can be assembled across several independently managed pension institutions. The scale of any compromise cannot be inferred simply from the number of affected funds, and a shared software platform does not prove that every customer record was accessible to the attacker.
The regulator’s focus on lawful transfers is distinct from an assessment of basic perimeter security. A provider might have followed a documented technical control framework while still leaving questions about the quantity of personal information entrusted to it and the purposes for which it was retained. Equally, a cyberattack does not itself prove that a transfer was unlawful. Investigators will need documentary and technical records to evaluate each issue on its own terms.
The commissioner said no further information could be given while the proceedings are pending. The supplier and affected funds face open questions about the extent of data extracted and the handling of personal information; no regulatory determination has been announced.
