On 22 October 2026 Switzerland's Federal Data Protection and Information Commissioner (FDPIC) opened a formal investigation into PK Softech AG, a software supplier to occupational pension funds, over suspected data protection and data security failures after a cyberattack on the company, according to the Digital Policy Alert tracker. We could not retrieve the FDPIC's own press release, so this analysis rests on press reports and the statute. The scope of the breach is still unconfirmed.
What is known, and what is not
Press reports place the attack at the end of September. IPE reported on 9 October that the supplier serves Publica, the federal pension fund, along with Pensionskasse Post, Migros Pensionskasse and Bernische Pensionskasse. The possibly affected data includes salaries, pension assets, benefit amounts and contact details. Publica said it could not yet determine which members, or how many, were affected, and the Federal Office of the Attorney General has opened a criminal investigation.
Bluewin reported on 18 October that data on more than 100,000 insured people may have been compromised, though this was unconfirmed. It also said PK Softech serves roughly a dozen funds. finews added that the Pension Fund of the City of Zurich said personal data of its insured persons had been stolen. The worst case there includes AHV numbers, dates of birth, insured salary and IBANs. The funds say pension assets and payments are not at risk.
Those are all reports of possible exposure. None of them establishes what was taken or how many people are affected.
The case for a tougher regime
The strongest argument for stricter rules is that the revised Federal Act on Data Protection (nFADP), in force since 1 September 2023, lets the FDPIC investigate and order changes but not fine companies. Under the Act, penalties are criminal fines of up to CHF 250,000 on responsible individuals, imposed by cantonal prosecutors. Critics argue this is weak next to GDPR-style administrative fines of a percentage of turnover. They add that a supplier holding the AHV numbers and bank details of tens of thousands of people faces little deterrent. On this view, a regulator without fining power invites under-investment in security.
Why the existing tools are the right ones
That argument underrates what the nFADP already provides, and the PK Softech case shows where. The statute (Federal Act on Data Protection, SR 235.1) requires appropriate technical and organisational security measures. It makes the pension fund as controller answerable for its processors, and it requires breach reports to the FDPIC. It also lets the Commissioner open an investigation when there are sufficient indications of a violation. The FDPIC's own reported approach fits that design. Its first aim is to establish what personal data the funds entrusted to PK Softech, and Commissioner Adrian Lobsiger has not ruled out widening the probe to federal bodies such as Publica, according to press reports. That is the right order of questions. Before any penalty, a regulator needs to know who decided what data went where, and who was responsible for protecting it.
The lesson is concentration risk. A dozen or so funds relying on one software vendor means one intrusion can expose several employers' workforces at once. Larger fines would not change that. Contracts, minimisation and procurement discipline would. Funds that pass full salary histories and bank details to a vendor, when a pseudonymised set would do, have made a design choice. The nFADP's data-minimisation principle already speaks to that choice.
A proportionate agenda
Three changes follow, none of which needs a rewrite of the law.
- Publish the findings. The FDPIC should issue a reasoned decision or report on processor oversight in occupational pensions, so every fund and vendor learns what "appropriate" security means in practice.
- Standardise supplier terms. Pension-sector bodies and procurement authorities, including the federal government as Publica's sponsor, should adopt baseline contract clauses. These would cover logging, segregation of client data, retention limits and incident notification deadlines.
- Resist reflexive penalty escalation. Swiss tech and fintech firms benefit from a regime that is predictable and not built around turnover-based penalties. If gaps in deterrence appear after the FDPIC's findings, Parliament can target them. It should not legislate in the middle of an incident.
The free-speech and openness angle is smaller here, but real. Breach investigations should not turn into mandates for blanket data localisation or heavy-handed monitoring of staff communications. Security failures are best addressed through accountable, documented controls.
What to watch
Three things will show whether the investigation is serious. First, whether the FDPIC confirms how many funds and people are involved. Second, whether it extends the probe to the funds as controllers, as Lobsiger has reportedly left open. Third, whether the outcome is published in enough detail to guide the rest of the market. The FDPIC's news page is where any release should appear. Until then, the investigation tells us only that the nFADP's supply-chain duties are now being tested on a live case. It does not yet tell us whether the Act is adequate.