BERN. The extortionists behind the cyberattack on the federal pension fund have named their price. The Akira ransomware group claims to hold around 100 gigabytes of compressed data stolen from Publica’s software supplier and is demanding a ransom, the Tages-Anzeiger reported on Tuesday. The haul potentially covers far more than 100,000 current and former federal employees, and the first fraud attempts exploiting the stolen identities are already under way.
The inventory of what may have leaked reads like the administration’s own personnel file: names, addresses, dates of birth, AHV numbers, telephone numbers, salaries, insured earnings, pension assets and details of spouses and partners. Publica counts about 66,000 active insured and 40,000 pensioners and says it cannot yet confirm whether all of them are affected. The pension money itself, the fund stresses, is safe.
What elevates the theft from a privacy disaster to a security emergency is who sits in the data. Intelligence officers, elite soldiers and former members of the Federal Council could all be identified in the files, a risk the government had already rated internally as grave, as this newspaper reported when the classification first became public at the weekend. Cross-checked against entry lists and social media, the files could unmask covert officers posted abroad; in the worst case, foreign authorities could question or detain them.
A group the police know well
Akira is no newcomer. The federal police have tracked the group for years and have warned Swiss companies about it repeatedly. It works by the double extortion method that has become the industry standard: steal the data first, encrypt the systems second, and then threaten to publish everything unless the victim pays. Its affiliates have hit businesses, hospitals and public bodies across Europe and North America, often entering through suppliers with softer defences rather than through the well protected institutions themselves.
That is precisely the path taken here. The attackers did not breach Publica directly but its external software supplier, the IT service provider PK Softech, which detected the intrusion at the end of September and filed a criminal complaint. The Office of the Attorney General has been investigating since, and the finance department informed the Federal Council last week. The pattern echoes the Xplain affair of 2023, when another federal IT supplier was raided and data from several offices spilled onto the darknet, and the attack on a shared supplier of the Bern Pension Fund days after the Publica disclosure suggests a deliberate campaign against the pension world’s quiet contractors.
Bern does not pay
Whether anyone in Bern is talking to the extortionists is unclear. Officially, the federal practice is not to negotiate with ransomware groups and not to pay, a line the National Cyber Security Centre repeats to every victim that asks. The calculation is cold: paying funds the next attack, guarantees nothing, and marks the payer as a willing customer. Against that stands the human arithmetic of more than 100,000 people whose most complete official profile may now be for sale.
The practical advice began reaching the insured this week. Treat unexpected calls, letters and messages that know too much about you as hostile until proven otherwise, Publica tells its members; the first fraud attempts doing exactly that have already been recorded. Parliament, which returns for the winter session with the judiciary already under scrutiny, will now ask how a supplier holding the pension files of intelligence officers was vetted, and why the public learned of the ransom demand from a newspaper rather than from the government itself.