Key Takeaways
- • Swiss federal pension fund Publica confirmed on October 8, 2026 that a cyber attack on an external software supplier may have exposed members' personal data, including that of ETH Zurich staff.
- • The attack occurred at the end of September 2026 at an external software supplier; the investigation into the exact scope of compromised data is ongoing.
- • Potentially affected data includes names, addresses, dates of birth, AHV numbers, contact details, salary information and pension savings details, and data on dependants and spouses or partners may also be involved.
- • Publica states that pension assets, its systems for managing pension assets and paying pensions, and pension savings are not affected by the breach.
- • Members are warned to be vigilant against phishing and social engineering using the leaked information, and are directed to contact Publica directly with questions.
Summary
Publica, the Swiss federal pension fund, informed its members by email on Thursday, October 8, 2026, that a cyber attack on one of its external software suppliers may have resulted in the leakage of personal data. The message was reportedly sent to both work and personal email addresses, and ETH Zurich published an internal notice on its Staffnet intranet relaying the incident to its staff.
According to Publica, the attack took place at the end of September at an external software provider. An investigation is underway to determine precisely which data was compromised. Data that may be affected includes names, addresses, dates of birth, AHV numbers, contact details, and information on salaries and pension savings. Because Publica may also hold personal details of spouses, partners and other dependants, the fund has asked members to inform those individuals as a precaution.
Publica has stressed that its own systems were not affected. The system used to manage pension assets and pay pensions was not compromised, and pension savings remain secure, according to the fund. Publica's pension operations were therefore not impacted, and members can continue to view their contact details, notification settings and pension savings through the mypublica policyholder portal.
The fund warned members to be especially cautious of unexpected emails, text messages or phone calls, since criminals could use the leaked information to impersonate trusted individuals or organisations and seek further personal data. Members were advised not to open suspicious links or attachments, not to disclose passwords or login details, and to contact Publica directly with questions or reports of suspicious activity.
According to Publica, the attack took place at the end of September at an external software provider. An investigation is underway to determine precisely which data was compromised. Data that may be affected includes names, addresses, dates of birth, AHV numbers, contact details, and information on salaries and pension savings. Because Publica may also hold personal details of spouses, partners and other dependants, the fund has asked members to inform those individuals as a precaution.
Publica has stressed that its own systems were not affected. The system used to manage pension assets and pay pensions was not compromised, and pension savings remain secure, according to the fund. Publica's pension operations were therefore not impacted, and members can continue to view their contact details, notification settings and pension savings through the mypublica policyholder portal.
The fund warned members to be especially cautious of unexpected emails, text messages or phone calls, since criminals could use the leaked information to impersonate trusted individuals or organisations and seek further personal data. Members were advised not to open suspicious links or attachments, not to disclose passwords or login details, and to contact Publica directly with questions or reports of suspicious activity.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.