Swiss prosecutors investigate data leak at federal pension fund Publica

Cyberattack on supplier triggers data leak at Publica

According to The Next Web, Publica, the Swiss federal pension fund, experienced a data leak following a cyberattack on one of its external software suppliers. The supplier discovered the attack at the end of September and subsequently filed a criminal complaint with federal authorities.

Publica has informed its members about the breach and its potential implications, though it has not disclosed the identity of the supplier or the type of data compromised. The fund serves around 70,000 active members and 41,600 pensioners, managing assets just under 45 billion Swiss francs as of the end of 2025.

Prosecutors launch investigation as details remain unclear

The Office of the Attorney General of Switzerland has opened an investigation into the data leak, according to reports. However, key details about the incident remain unknown, including the extent of the breach, the specific data accessed, and the number of affected members.

Publica has stated that no other federal agencies are known to work with the same supplier, limiting the potential fallout beyond its own members.

Switzerland’s history of supplier-linked cyber incidents

The Publica breach follows other high-profile cyberattacks in Switzerland involving third-party suppliers. In 2023, the Play ransomware group leaked approximately 907GB of data stolen from Xplain, an IT company serving multiple federal agencies.

That same year, Concevis, a supplier for the Federal Statistical Office and the Federal Tax Administration, was also hit by a ransomware attack, resulting in the theft of older federal data.

What this means

Lazyfounder analysis — our interpretation, not reported fact.

This incident underscores the growing risk of cyberattacks targeting third-party suppliers—a weak link that can expose even well-protected institutions like pension funds. For founders and operators, it highlights the need for rigorous vendor security assessments, contractual safeguards, and incident response plans that account for third-party breaches. The prolonged uncertainty surrounding the investigation also illustrates the reputational and operational challenges organizations face when critical details remain undisclosed. For public institutions, this case reinforces the importance of proactive communication with stakeholders, even in the absence of full clarity, to maintain trust and manage expectations.

Key takeaways

• Third-party suppliers are a critical vulnerability for sensitive institutions like pension funds, amplifying risks even when direct security measures are robust.
• Transparency with stakeholders is essential, but communicating uncertainty—such as undisclosed breach details—can undermine trust and complicate mitigation efforts.
• Regulatory investigations into cyber incidents can be prolonged, leaving organizations and affected individuals in limbo over the long-term implications.
• Pension funds and government-linked entities are increasingly targeted, reflecting their high-value data and potential for cascading impacts on public trust.

FAQ

What is Publica?

Publica is the Swiss federal pension fund, providing pension coverage for employees of the Swiss federal government and the ETH Domain. It is one of the largest pension funds in Switzerland, with around 70,000 active members and 41,600 pensioners as of the end of 2025.

How did the data leak at Publica happen?

The data leak occurred due to a cyberattack on one of Publica’s external software suppliers. The supplier detected the attack at the end of September and filed a criminal complaint.

What information is known about the data breach?

Little is currently known about the breach. It is unclear what data was accessed, how many Publica members are affected, or when the investigation will conclude. Publica has not disclosed the identity of the supplier or the type of data compromised.

Has Publica notified its members about the breach?

Yes, Publica has informed its members about the breach and its potential implications, though details about the scope and impact remain limited.

Are other federal agencies affected by this breach?

According to Publica, no other federal agencies are known to work with the same supplier involved in the breach.

Related on Lazyfounder

• More policy news