What the regulator actually did
On 23 October 2026, Switzerland's Federal Data Protection and Information Commissioner (FDPIC) announced that PK Softech AG had told it on 8 October of a cyberattack on its IT infrastructure and possible breaches of data security. According to the FDPIC's notice, data was extracted from several pension funds, including the Confederation's fund, Publica. The FDPIC opened an informal preliminary inquiry with Publica on 14 October. It opened a formal investigation into PK Softech on 22 October. The notice says no further information on pending proceedings can be provided at present, and it gives no figure for the people affected.
The sequence matters. The regulator went formal against the supplier and stayed informal with the pension fund. That is a defensible reading of where the failure sits.
The case for a hard line
The strongest argument for aggressive enforcement is the nature of the data. Press reports describe the exposed material as including AHV (social security) numbers, salaries and account numbers. Blue News reported on 18 October that data on more than 100,000 insured individuals may have been compromised, but said this was not confirmed. It also reported that nearly a dozen other pension funds use the supplier, and that staff of the intelligence service, the army and Fedpol are at particular risk.
Pension data cannot be rotated like a password. An AHV number or an account number stays with a person for decades, and people in sensitive public roles face risks beyond fraud. Anyone arguing for restraint has to start from that.
Why the supplier is the right target
The revised Federal Act on Data Protection (nFADP) already allocates responsibility along the chain. Article 24 FADP requires a controller to notify the FDPIC "as quickly as possible" of a breach likely to lead to a high risk. Paragraph 3 requires a processor to notify the controller of any breach as quickly as possible. The FDPIC's breach guidance covers the high-risk threshold and the duty to inform data subjects. The statute sets no numeric deadline.
The timeline in the notice shows that regime working in at least one respect. The FDPIC was informed on 8 October, and a preliminary inquiry with Publica began six days later. A formal investigation followed 14 days after the first notice. The reports say the attack began in late September, so the gap between compromise and regulator notification is itself something the investigation should clarify. That is a question about whether a vendor met its reporting duty, not about whether Publica was negligent.
The investigation, per the notice, will examine three things:
- what personal data the pension funds passed to the supplier,
- the legal framework for those transfers,
- how much information actually left.
Those are the right questions. The most useful outcome would be findings on data minimisation in outsourcing. Did a pension-administration vendor need salary and account data for every function it performed? Did it need to hold that data in a form that could be extracted in bulk?
Where proportionality should bite
The risk is what happens after the investigation. Three responses would make Swiss data governance worse without making citizens safer.
Blanket liability for the downstream victims. Publica and the other funds did not breach their own systems. The reports say Publica was not hacked directly. If the lesson drawn is that every institution is strictly liable for every vendor failure, the rational response is to avoid specialised domestic suppliers and consolidate onto a few very large providers. That concentrates systemic risk, which is the opposite of resilience.
Localisation or vendor-licensing mandates. A mid-sized Swiss software firm in Reinach, near Basel, was compromised. That says nothing about whether the answer is a state-approved vendor list. Such lists favour incumbents and slow the adoption of better tools. Outcome-based security obligations scale better than approval regimes.
Treating notification as an admission. The FDPIC learned of this because PK Softech reported it. Regulators should want faster reporting, not a regime that makes early disclosure the start of a penalty clock. Enforcement should distinguish firms that report promptly and cooperate from those that conceal.
What to watch
First, whether the FDPIC publishes findings or only a closing note. Procurement teams across Swiss public bodies and private funds need to know what "appropriate" vendor controls look like in practice, and a reasoned decision teaches more than any guidance document.
Second, whether the FDPIC extends the formal investigation beyond the supplier. The press notice says only that Publica is the subject of an informal preliminary inquiry. Any escalation should rest on specific failures in what Publica shared and why, not on the fact of the breach.
Third, the final headcount. Until a verified number of affected people exists, claims about harm are estimates. The notice gives none, and the 100,000 figure remains an unconfirmed press report.
The measured reading is that the FDPIC is doing what a data protection authority should: it moved within two weeks, targeted the party that lost control of the data, and said little before it has facts. The policy challenge is to make the final decision produce clearer vendor-governance expectations rather than a general chilling effect on outsourcing. Switzerland's pension funds will keep using external software providers. The law should make those providers accountable without making the funds that depend on them the main casualties.