Swiss Watchdog Opens Probe Into PK Softech

Switzerland’s Federal Data Protection and Information Commissioner (FDPIC) has opened a formal investigation into PK Softech AG, a supplier of pension fund software, after data from several pension funds was taken in a cyberattack on the company. The commissioner’s release, published on 23 October, says the investigation is being conducted on suspicion of breaches of data protection rules. It is not a finding that rules were broken.

PK Softech told the commissioner about the attack on 8 October. Among the funds whose data was taken is Publica, the pension fund of the Swiss federal government, according to the FDPIC. After opening an informal preliminary inquiry at Publica on 14 October, the commissioner opened the formal investigation against PK Softech on 22 October, 14 days after the company’s report.

“Further information on pending proceedings cannot be given at this time,” the release says (translated by TSN). TSN tracks attacks like this on its ransomware and cyber attacks hub.

In brief

Switzerland’s data protection commissioner opened a formal investigation into PK Softech AG on 22 October, on suspicion of data protection violations.
Data from several pension funds, including the federal fund Publica, was taken in a cyberattack on the software supplier at the end of September.
Publica says pensions are safe; it and other funds warn members to watch for convincing scam calls and messages.

What the commissioner wants to establish

The FDPIC says it wants an overall picture of the personal data that the affected pension funds made available to the software company. It also wants to clarify the legal framework for those data transfers, how they were carried out in practice, and the extent of the information that leaked. The commissioner says data was taken from “several major” occupational pension institutions for which PK Softech provided software.

PK Softech, based in Reinach near Basel, says it was the victim of a cyberattack at the end of September. In a notice on its website, it says unknown attackers used malware to gain access to part of its IT infrastructure. “Based on current knowledge, it must be assumed that data has been taken from our systems,” it says (translated by TSN), adding that the type and exact scope of the data are still being examined. The company says it disconnected the affected environment, brought in outside specialists, informed the authorities and filed a criminal complaint. It has been fully available to customers again since 2 October.

The Bernese Pension Fund (BPK) gives more detail. In a letter to members dated 14 October, it says software that encrypts data (ransomware) was installed at one of its software suppliers on 29 September, and that on 8 October it became known that data had also been stolen. The Swiss news site watson has reported that the Akira ransomware gang was behind the attack.

What members have been told

Publica’s incident page says further investigation has shown that personal data of insured people was probably taken. It lists the data that could be affected: names, dates of birth, AHV social security numbers, addresses, phone numbers, email addresses, salary and pension details, marital status, partner details and IBAN bank account numbers. The Office of the Attorney General of Switzerland is investigating, Publica says.

Publica stresses that members’ pension savings and pensions are safe and that its own production system was not affected. As of 20 October, it had seen no sign that the data had been published on the dark web. Tages-Anzeiger has reported that the data of “well over 100,000” federal employees was involved, according to watson. Publica and the FDPIC have not given a number.

The two Bernese funds are less certain. The BPK says it is still unclear whether its members’ data was taken, and that it filed its own criminal complaint on 19 October. The Bernese Teachers’ Insurance Fund (BLVK) said on 16 October that personal data was taken in the attack, but that it does not yet know whether its members’ data is among it.

All three funds give the same advice. Be wary of unexpected emails, calls and messages, leave suspicious links and attachments unopened, and never give passwords, access codes or personal details to someone who contacts you out of the blue. Publica says it never asks for passwords or access details by email, text or phone, and recommends typing your bank’s web address into the browser yourself.

The probe tests the funds’ data sharing as much as the breach

The commissioner’s stated aims go beyond the attack itself. By asking what data the funds handed over, on what legal basis and how that was done in practice, the FDPIC is examining the relationship between the funds and their supplier, not only the supplier’s defences. Publica’s own published FAQ asks the same question its members are asking: why insured people’s data was held by an outside provider at all. Its answer so far is that it is checking how that data was stored on PK Softech’s servers and how it was protected.

That puts the focus on a familiar weak point. As in the NEC contractor breach in Japan and the attack on cloud provider Arcadia, the organisation whose people are exposed is not the one that was breached.

Identity data is the lasting risk, not pension money

The funds agree that the money is safe. The danger lies in the data. An AHV number, salary, address and IBAN together give fraudsters enough to make a call or email look genuine, which is exactly the risk Publica describes. Unlike a password, none of those details can easily be changed.

The commissioner has not said how long its investigation will take. Until it reports, and until PK Softech and the funds can say whose data was taken, members of the funds involved are best served by treating any unexpected contact about their pension, salary or bank as suspect. The same caution applies after other recent breaches of member data.