Pensionskasse Stadt Zürich Reports Data Breach in Cyberattack on Software Provider
The Pensionskasse Stadt Zürich (PKZH) announced that personal data of its 41,000 insured individuals were stolen in a cyberattack targeting an external software provider. The breach, which occurred at the end of September, involved data transferred to PK Softech, the same company linked to a separate attack on the Swiss Federal Pensionskasse (Publica), nzz.ch reported.
Data Types and Scope of the Breach
The PKZH stated that while pension funds and retirement payments remain secure, personal information such as names, addresses, email addresses, phone numbers, AHV (Swiss social insurance) numbers, marital status, partner details, and bank account information may have been accessed. The exact number of affected individuals and the full scope of the breach are still under investigation, sda reported. Im schlechtesten Fall umfasst das Datenleck persönliche Kontaktdaten (Name, Adresse, E-Mail, Telefonnummer), die AHV-Nummer, den Zivilstand, Angaben zu Partnern, die IBAN sowie Vorsorgedaten wie den versicherten Verdienst und das Guthaben.
System Integrity and Ongoing Investigations
The PKZH emphasized that its core administrative system, responsible for managing pension funds and disbursements, was not affected by the attack. However, the breach occurred during preparations to transition to a new system provided by PK Softech, a process scheduled to be completed by early 2027. The PKZH has filed a criminal complaint, and officials are working with PK Softech to determine the extent of the data exposure, nzz.ch stated. Diese Datenpanne trifft die PKZH aber so oder so in einer heiklen Phase, weil das neue System schon in wenigen Wochen live gehen soll.
Broader Impact on Swiss Pension Funds
The attack has also impacted other institutions, including the Bernische Pensionskasse (BPK) and the Bernische Lehrerversicherungskasse. So wurde vergangene Woche bekannt, dass auch Daten der Bernischen Pensionskasse (BPK) und der Bernischen Lehrerversicherungskasse entwendet wurden.
Concerns Over Test Data Usage
Helga Portmann, the managing director of PKZH, acknowledged that test data from insured individuals was used during system tests, highlighting concerns about the security of real personal information. Dabei arbeiten wir mit Testdaten von Versicherten.
Zuvor hatte die Pensionskasse des Bundes Publica über den Angriff bei derselben externen Softwarefirma informiert, bei der sie ebenfalls Kundin ist.
Breach Details and Mitigation Steps to Be Shared
Additional details about the breach and mitigation steps will be shared as they become available.
FAQ
What types of data were potentially compromised?
The breach may have exposed personal contact details, AHV numbers, marital status, partner information, and bank account details, according to nzz.ch. Die Publica betont, dass sowohl das Vorsorgeguthaben als auch die Rente sicher seien.
How many people are affected?
The exact number of affected individuals is still being determined, with investigations ongoing, sda reported.
Is the pension funds’ financial data at risk?
The PKZH confirmed that pension funds and retirement payments are secure, as the attack did not target its core administrative system, nzz.ch stated.
PKZH’s Workforce and Assets
The PKZH, one of Switzerland’s largest pension funds, serves 41,000 insured individuals and 21,000 pensioners, managing a portfolio of approximately 25 billion Swiss francs, nzz.ch reported. Die PKZH befindet sich mitten im Wechsel zu einem System von PK Softech – das ist jenes Unternehmen, bei dem die Daten der Pensionskasse des Bundes entwendet wurden.
Worth a look