BERN. The federal government has internally classified the data leak at Publica, the pension fund for federal staff, as grave, and the alarm is concentrated where it matters most: the security services. A confidential information note reported by SonntagsBlick names the Federal Intelligence Service, the army and the Federal Office of Police as particularly exposed, because the stolen data could be used to unmask officers working covertly abroad.
The fear is arithmetic rather than exotic. Pension files hold names, addresses, dates of birth, salary histories and career breaks. Cross-checked against entry and exit lists and the traces people leave on social media, such files could identify intelligence staff posted overseas under cover. In the worst case, officials concede, those officers could face questioning or even arrest by foreign authorities. Whether data of that sensitivity was in fact stolen remains unconfirmed.
Finance Minister Karin Keller-Sutter informed the Federal Council about the incident on Wednesday. The Office of the Attorney General has opened an investigation, and Publica has stood up a crisis team. The fund says it is still establishing which data and how many people are affected, and warns that the clarification could take weeks or months. The defence department declines to comment on a report that security state secretary Markus Mäder has been given a confidential mandate.
A supplier, not the fund itself
The attackers did not breach Publica directly. They hit an external software supplier, identified in Swiss reports as the IT service provider PK Softech, which detected the attack at the end of September and filed a criminal complaint. Publica disclosed the leak to policyholders this month, stressing that no other federal agency has a business relationship with the company, a detail meant to limit fears of a wider spill through the administration.
The supply chain problem returns
The incident is the third of its kind in weeks. Days after the Publica disclosure, a shared software supplier of the Bern Pension Fund and the teachers insurance fund was hit in what looks like a campaign against the quiet contractors of the pension world. The Federal Office for Cybersecurity has warned for years that the weakest point of a well defended institution is often a supplier with softer systems, and parliament has tightened reporting duties for critical infrastructure in stages since 2023.
The political questions will follow the forensic ones. MPs will want to know how a supplier holding the pension data of intelligence officers was vetted, what it was obliged to report and when, and why the classification of the incident reached the public via a Sunday paper rather than from the government itself. For the more than 110,000 people whose pensions Publica manages, the advice for now is the advice that follows every such breach: treat any message that knows too much about you as hostile until proven otherwise.