Swiss data watchdog opens formal investigation into PK Softech pension-fund breach

Switzerland’s Federal Data Protection and Information Commissioner has opened a formal investigation into PK Softech, the software provider for several Swiss pension funds, after a cyberattack in which data was stolen from the funds it serves, SWI swissinfo.ch reported on Saturday, citing the commissioner’s statement.

The formal investigation into PK Softech follows an informal preliminary investigation opened at the Federal Pension Fund Publica on 14 October. PK Softech informed the commissioner on 8 October that its IT infrastructure had been attacked and that possible data-security breaches had occurred.

Publica is among the organisations affected, along with the Bernese Pension Fund (BPK) and the Bernese Teachers’ Insurance Fund (BLVK). The pension funds concerned have also lodged a complaint over the matter.

The commissioner expects the investigation to establish a comprehensive overview of the personal data the pension funds made available to the software company. The legal framework governing those data transfers, how it was implemented, and the extent of the information stolen still need to be clarified, the statement said.

The intrusion was detected at the end of September. PK Softech filed a criminal complaint, and the Office of the Attorney General has opened a criminal investigation into the breach.

Sources: SWI swissinfo.ch (https://www.swissinfo.ch/eng/swiss-industry/cyberattack-data-protection-officer-launches-investigation/92266851); Escudo Digital (https://www.escudodigital.com/en/cybersecurity/thousands-of-swiss-pensioners-may-have-been-affected-by-a-data-breach.html); Beyond Machines (https://beyondmachines.net/event_details/swiss-federal-pension-fund-publica-exposed-to-data-leak-via-software-supplier-k-i-s-2-z).