Hacker attack on PK Softech: 27.000 IPCT members at risk

Context

TL;DR

• 27'000 IPCT members could be victims
• Attack on PK Softech in late September
• Data on several hundred people in an IPCT folder
• IPCT is preparing a letter to policyholders

Key facts

• What → hacker attack on supplier PK Softech
• When → late September
• IPCT population → 27'000 affiliated people
• Data on the server → information on several hundred insured persons
• Letter → 17'000 active members and 10'000 pensioners
• Investigation → Office of the Attorney General of Switzerland
• Group mentioned → Akira

The attack and the Ticino population

In late September, a hacker attack hit PK Softech, the software provider for numerous Swiss pension funds. According to the information in the report, the company’s server contained a folder named IPCT that contained data on several hundred insured persons. IPCT is the Pension Institute of the Canton of Ticino.

The possible Ticino scope is broader than the identified folder: 27'000 people affiliated with IPCT could be victims of the attack. The figure therefore describes the potential group indicated by the source, not a list of people for whom data theft has already been confirmed. The source specifies, in fact, that the extent of the damage in Ticino is not yet known.

Daniele Rotanzi, director of IPCT, highlighted the diversity of its members: they include teachers, administrative employees, state councillors, police officers and judges, as well as nursing-home staff and social workers from associations. This is the professional description provided by the director; the report does not offer a breakdown by place of residence or cross-border commuter status.

“For now, we do not know for certain whether data relating to our insured persons are present.”

Rotanzi’s statement clarifies the main limitation of the report. The figure of 27'000 concerns the members who could be involved; the figure of several hundred concerns the data present in the IPCT folder identified on the server. The source does not establish whether the two figures coincide, or whether all the information in the folder was taken. Meanwhile, IPCT has announced a letter to its members, probably in the following week, to inform them of what happened and the possible risks, including the use of personal information by third parties.

Operational details

The count of policyholders

The decision to write to all policyholders allows an internal numerical comparison within the same communication. IPCT indicates 17'000 active people and 10'000 pensioners; the sum is 27'000. The basis is therefore the breakdown of the group communicated after last Friday's meeting. The source does not present these values as a time series.

The calculation does not prove that all members of the two groups have been affected. It only shows how the total number of members is distributed in the communication announced by the institution. This is also a useful distinction because the report simultaneously refers to a potential group of 27'000 people and a folder containing data on several hundred people: the first figure concerns membership in IPCT, the second the documentation found on the server.

For a cross-border worker working in Canton Ticino, however, the source does not support an interpretation based on personal status. It does not quantify cross-border workers and does not indicate how many members have a G permit; it does not address withholding tax, tax rebates, LAMal, INPS, Brogeda or double taxation. These terms refer to topics that the report does not measure. It is therefore not possible to derive from this episode a proportion of cross-border workers involved, nor to link the possible risk to a tax regime or a specific border crossing.

As previewed, the content of the letter is more precise from a communications standpoint: IPCT wants to inform policyholders of the possibility of a personal data leak and of the possible use of that data by third parties. The tone will be calm. Policyholders will be told that pensions and contributions are safe, along with a warning to pay attention to unusual emails or phone calls. The source thus separates the security of pensions and contributions from the possibility of improper use of personal information.

Key points

The comparison with Publica and the judicial follow-up

The reference to the Confederation's Publica pension fund helps keep the different aspects of the case separate. For Publica, the report states that information was stolen and identifies a population of 100'000 people at risk, including federal councillors, agents and military personnel. For IPCT, by contrast, the text speaks of a possibility: there is still no information on the extent of the damage in Ticino, and there is no certainty that insured persons' data are involved. The 100'000 for Publica and the 27'000 for IPCT cannot therefore be added together: they refer to two different pension funds, even though the attack hit the same software provider.

According to Tages-Anzeiger, the hackers have allegedly already demanded payment of a ransom. The conditional remains necessary even with reference to the Akira group: the hackers might have access to various types of personal data, from first and last name to the AVS number, including address, telephone number, email, pension data and IBAN. The list describes categories of potentially exposed information, but does not confirm that every field is present in the IPCT file or that it was stolen from insured persons in Ticino.

On the judicial front, the Office of the Attorney General of the Confederation has opened an investigation. IPCT then filed a criminal complaint requesting to be recognized as a private prosecutor, with the stated aim of maximizing the information it might receive. This is the follow-up documented in the source; no outcome of the investigation is reported, nor is there any definitive finding regarding the IPCT data.

Even for cross-border workers, the verifiable fact is therefore not an already established individual loss. The report does not identify insured persons, quantify the proportion of members potentially involved, or say that the data in the file were stolen. Instead, the report documents the attack on PK Softech, the presence of the IPCT file, the communication planned for insured persons and the legal initiatives launched. The information gap concerns precisely the extent of the damage in Ticino, which remains to be clarified.

Source: ticinonews.ch