--- title: "Breached through a supplier: what the Publica case asks of you" summary: "Data left a software supplier of Publica, the federal pension fund. What happened, what Swiss law asks of whom, what we commit to, and what to check now." author: "Samuel Krauss" author_title: "Founder" publisher: "Elchi Studios" published: 2026-10-12 updated: 2026-10-12 url: https://elchi.dev/en/journal/breached-through-a-supplier-the-publica-case language: en tags: ["security","data-protection","switzerland","suppliers"] words: 1167 --- # Breached through a supplier: what the Publica case asks of you *By Samuel Krauss, Founder. Published 12 October 2026.* > Data left a software supplier of Publica, the federal pension fund. What happened, what Swiss law asks of whom, what we commit to, and what to check now. On 8 October 2026 Publica, the pension fund of the federal administration, announced that data had left the systems of one of its software suppliers. Publica itself was not broken into. The supplier was. Any company or administration that hands personal data to an outside firm should read this case closely. ## What happened According to Publica and the Federal Council, an external software supplier detected a cyberattack at the end of September. It filed a criminal complaint and informed the responsible federal bodies, Publica and its other customers. The Office of the Attorney General of Switzerland has opened an investigation. No other federal office has a business relationship with the supplier. Publica did not name the company. Watson and Inside IT identified it as PK Softech AG in Reinach BL, which has supplied the software Publica uses to administer its members and pensioners since 2017. PK Softech stated that attackers reached part of its IT infrastructure with malware, that it isolated the affected environment, and that it has to assume data left its systems. Its services have been available again since 2 October. Publica insures staff of the federal administration and the ETH domain: about 70,000 active members and 41,600 pensioners at the end of 2025. On 8 October it emailed the members whose address it had. The others, and the pensioners, are to receive a letter in the following days. According to that letter, as reported by Watson, the data possibly affected includes names, dates of birth, AHV numbers, addresses, phone numbers, email addresses, salary, insured salary, retirement assets, marital status and details of spouses or partners. Which of it actually left is still being established. Publica is not the only customer. On 9 October Inside IT named further PK Softech customers, among them the Bernische Pensionskasse, the Bernische Lehrerversicherungskasse, the Migros-Pensionskasse, the Pensionskasse Post and the Syngenta Pensionskasse. Some of them have said publicly that they are checking possible data outflows together with PK Softech. The director of the Bernische Pensionskasse told the news agency Keystone-SDA there were no signs that members' data had been stolen, but that it could not be ruled out entirely. ## Why this is the normal case A pension fund buys its administration software. A medical practice buys its patient system, a municipality its registry software, a fiduciary its accounting. The data stays the responsibility of whoever collected it, but it can sit with the supplier as well: in a hosted system, in a backup, in a copy made for support or testing. An attacker who wants the data of fifty clients has one door to try instead of fifty. Switzerland has seen this before. After the attack on Xplain, an IT supplier to federal offices, the Federal Council adopted measures on 1 May 2024 to prevent data outflows at IT suppliers to the federal administration. The lesson then and now is the same: a contract decides how fast you learn about a breach, and what the supplier was allowed to keep in the first place. ## What the law asks, and of whom The Swiss Data Protection Act splits the duty in two. The controller, the company or authority that decides why the data is processed, must report a breach to the Federal Data Protection and Information Commissioner (FDPIC) as soon as possible when it is likely to lead to a high risk for the people concerned. The processor, the supplier, must tell the controller about every breach of data security, whether or not it looks risky. The people affected must be told when they need to protect themselves, for example by changing a password, or when the FDPIC requires it. The FDPIC's guide on these reports adds two points that matter here. With a ransomware attack, depending on the circumstances, a controller cannot wait for lengthy investigations before reporting. And where a high risk cannot be ruled out, it must not wait until it is certain whether personal data was affected. So the clock that matters starts at your supplier. If your contract says nothing about how fast the supplier has to tell you, you learn about it when the supplier decides to tell you. ## Where Elchi Studios stands For the websites and projects we host for clients, we are the supplier in this story. This is what our published texts commit us to, and what they do not. The data processing agreement for website and hosting clients, version 1.6, obliges us to notify the client of any personal data breach without undue delay, and within 24 hours of becoming aware of it at the latest (clause 4.6). It names every sub-processor with its country (clause 5.1). When the contract ends, we return or delete the data at the client's request, unless the law requires us to keep it, and confirm the deletion in writing on request (clauses 8.1 and 8.2). For clients bound by professional secrecy, such as law firms and medical practices, who have told us so, every access by our staff to their content is logged, and the client receives the log on request (clause 11.3). Stored data sits on our own servers at European providers in Switzerland, Germany, the Netherlands and France. Our [trust page](https://elchi.dev/en/vertrauen) names the four exceptions and what each one sees: Resend for notification emails, Stripe for EMX Team payments, Cloudflare for our DNS zones and Spamhaus for the spam filter's blocklists. A client can export at any time without asking us: EAuth accounts with their password hashes, EMX mailboxes over IMAP or the API, and the texts, images and data of a website. What we do not have: an ISO 27001 certificate, a SOC 2 report or an independent security audit. The trust page says so. We can be attacked like any other supplier. What we can promise is the deadline, the list of who else holds the data, and that a client can leave with all of it. ## What to check this week 1. **List every supplier that holds or can reach personal data.** Not only hosting. Include the vendor of your specialist software with remote support access, and anyone who received a copy for a migration or a test. 2. **Find the breach clause in each contract.** You want a deadline in hours. "Promptly" is not a deadline. 3. **Ask where copies sit.** Production, backup, support, test. PK Softech said its test systems generally hold no plaintext data. Ask your supplier whether it can say the same, in writing. 4. **Check the end of the contract.** Is the supplier obliged to delete, and will it confirm the deletion? 5. **Decide now who reports.** Name the person who decides on a report to the FDPIC and who informs the people affected, and keep a draft of both. The FDPIC is clear that you do not wait for certainty. 6. **If you are insured with one of these funds,** Publica advises caution with unusual emails, calls and messages. A caller who knows your AHV number and your salary has not proved that he works for your pension fund. ## Sources 1. [Cyberangriff auf Softwarelieferant von Publica: Datenabfluss bestätigt](https://www.admin.ch/de/newnsb/FjG4XOIms04s), Swiss Federal Council, read 2026-10-12 2. [Cyber attack on Publica software supplier: data leak confirmed](https://www.publica.ch/en/about-us/news/cyber-attack-publica-software-supplier-data-leak-confirmed), Publica, read 2026-10-12 3. [Cyberangriff: Bundespensionskasse Publica meldet abgeflossene Daten](https://www.srf.ch/news/schweiz/cyberangriff-bundespensionskasse-publica-meldet-abgeflossene-daten), SRF, read 2026-10-12 4. [Pensionskasse des Bundes: Cyberangriff auf Publica-Softwarefirma](https://www.watson.ch/schweiz/digital/228405160-pensionskasse-des-bundes-cyberangriff-auf-publica-softwarefirma), Watson, read 2026-10-12 5. [Datenabfluss bei Pensionskasse des Bundes](https://www.inside-it.ch/datenabfluss-bei-pensionskasse-des-bundes-20261008), Inside IT, read 2026-10-12 6. [Weitere Pensionskassen prüfen Datenabflüsse](https://www.inside-it.ch/weitere-pensionskassen-pruefen-datenabfluesse-20261009), Inside IT, read 2026-10-12 7. [Cyberangriff auf Softwarefirma betrifft auch Berner Pensionskassen](https://www.cash.ch/news/cyberangriff-auf-softwarefirma-betrifft-auch-berner-pensionskassen-975542), cash.ch, read 2026-10-12 8. [Leitfaden des EDÖB betreffend die Meldung von Datensicherheitsverletzungen und Information der Betroffenen nach Art. 24 DSG](https://www.edoeb.admin.ch/dam/de/sd-web/T64CAUyvAMcF/1_2%20Leitfaden%20des%20ED%C3%96B%20betreffend%20die%20Meldung%20von%20Datensicherheitsverletzungen%20und%20Information%20der%20Betroffenen%20nach%20Art.%2024%20DSG_DE.pdf), FDPIC (EDÖB), read 2026-10-12 9. [Cyberangriff auf Xplain: Massnahmen zur Vermeidung von künftigen Datenabflüssen sowie Sicherheitsprüfung nach der Übernahme des Unternehmens](https://www.admin.ch/de/nsb?id=104169), Swiss Federal Council, read 2026-10-12 10. [Trust: data location, CLOUD Act, security](https://elchi.dev/en/vertrauen), Elchi Studios, read 2026-10-12