BERN. Swiss public broadcaster SRF reported that the criminal group Akira demanded a ransom after stealing data from the software supplier of Publica, the pension fund for federal staff. The group threatened to publish the data or to sell them. The Federal Department of Defence is aware of the extortion, several sources told SRF. The State Secretariat for Security Policy, which sits in that department, then gave a narrower account. On Tuesday its spokesperson, Ursina Bentele, said the federal offices handling the incident know of no specific ransom demand addressed to them, and that the Confederation has paid nothing.
Publica put a correction on its own website, dated Wednesday. The federal authorities involved are not aware of any specific ransom demand. The supplier, PK Softech, received general extortion messages straight after the attack. Those messages were not followed by a named sum or a deadline. Publica itself has had no contact with the group and has received no demand. The Office of the Attorney General is investigating. More than a month on, neither Publica nor the secretariat has found the stolen material published on the dark web, and Publica says it knows of no member who has been contacted or harmed in a way that can be tied to the attack.
What is not in dispute
The attack itself is not in dispute. PK Softech, which builds software for pension funds, told Publica at the end of September that it had been hit. The data at risk were in a test environment at the supplier, not in the system Publica uses to record assets and pay pensions. That productive system is still running. Publica says pensions are being paid and that pension assets are safe. The supplier filed a criminal complaint and told its other customers, among them the pension fund of the city of Zurich.
What may have been copied is personal, and in some cases financial. Publica’s own list of fields that could be affected runs from name, date of birth and OASI number to address, private and work phone numbers and email, salary and pension figures, marital status, a spouse or partner, and an IBAN. The fund still cannot say whose records were actually taken. It has told members it will write to them when it can.
Why the defence ministry is in the room
The sensitivity is not the pension arithmetic. SRF’s sources say the working assumption in Bern is that information on the federal workforce as a whole may be in the stolen set, more than 100,000 current and former employees. That workforce includes staff of the Federal Intelligence Service and the Federal Office of Police who operate under false identities in Switzerland and abroad. A list that ties a real name, an address and a salary to a person whose public life uses another name is the sort of material a foreign service would buy. Nicolas Mayencourt, who runs the cybersecurity firm Dreamlab Technologies and advises authorities on extortion cases, told SRF he sees no reason to doubt the denials from Publica and PK Softech. The obvious reading, he said, is that any demand was lodged with the Confederation.
He also noted what has not happened. A month after an attack of this kind, publication is the usual pressure. There is none. He offered three explanations, and they are explanations, not findings: a ransom has been paid, the data have been sold elsewhere, or the talks are being stretched on purpose. Federal Council spokesperson Nicole Lamon told SRF the government discussed Publica the previous Wednesday and would say nothing further. The National Cyber Security Centre’s public line is unchanged. It advises against paying a ransom and against contacting the people who sent the demand. The police are the office to call.
What a member should do this week
The argument in Bern does not change the advice to the people in the file. Publica will not ask for a password, a login or a one-time code by email, text or phone. A message that does is not Publica, whatever address it appears to come from. The fund’s genuine notes about this incident came from uk@publica.ch, with the subject “Cyber attack on software supplier”, and ordinary portal mail comes from noreply@publica.ch. Sender lines can be faked. The safe path is to open myPublica by typing the address, not by following a link in a surprise email. Suspicious messages can be reported to the National Cyber Security Centre, which uses the reports to spot patterns.
This newsroom reported in October that Akira was demanding a ransom for a haul it described as federal pension data. Bern had already rated the leak grave, because of the risk to officers posted under other names. Wednesday’s correction does not close that file. It says the demand, if it is specific, has not been presented to the offices that would have to answer it, and that no ransom has been paid. Until the attorney general or Publica says whose data left the building, the prudent assumption for a federal employee is the one the fund has already printed. Your record may be in the set. Your pension is still there. Anyone who asks you to prove it by handing over a password is running a second fraud on the back of the first.