Akira hackers steal data of 100.000 federal employees from Publica

Context

TL;DR

• More than 100’000 federal employees affected
• Data also relating to partners and children
• The attack on an external supplier dates back to late September
• Akira threatens to publish or sell the data

Key facts

• What → Information theft affecting Publica
• Who → Akira hacker group
• Scope → Over 100’000 people
• When → Late September
• Data → Names, dates of birth, addresses, salaries and phone numbers
• Threat → Publication or sale of the data
• Development → The true scope emerged on Tuesday
• RUAG precedent → It had decided to pay after the attack on the US subsidiary

The 11.00 news bulletin on October 21, 2026 reports that the information theft affecting Publica is more serious than expected. Akira’s hackers obtained the personal data of nearly all federal employees of the Confederation: over 100’000 people, including both those still working and those no longer employed by the Confederation.

The list includes officials, judges and even secret agents, as well as former federal councillors. The cyberattack targeted an external provider and dates back to late September. It had already been known for a couple of weeks, but its true scale emerged on Tuesday through articles published by media outlets in the Tamedia group.

The data and the hackers’ demand

The information in the criminals’ possession includes contact details — addresses and phone numbers —, personal details such as names and dates of birth, salary data and additional information concerning partners and children. The source does not describe a simple contact list: it brings together personal details, contact details, remuneration and family-related data.

The hackers are reportedly demanding payment of a ransom. Otherwise, they threaten to publish or sell the data. Publica has reportedly not yet informed those affected about the payment demand; in the meantime, some have already been targeted by attempted scams.

Operational details

The scope described by the report

The case can be viewed through two dimensions that the report makes explicit: who is included in the group and what types of information were stolen. The first goes beyond the scope of active employees, because the theft also concerns people who are no longer employed by the Confederation. The second goes beyond basic identification: alongside names appear dates of birth, addresses, telephone numbers and salary data.

The text also mentions partners and children. The reference to the data, therefore, does not stop at the individual person included in the list. The categories indicated can be reordered as follows:

The categories of information indicated

The distinction between active employees and former employees is relevant to describing the extent of the theft, but the source does not provide a numerical breakdown between the two groups. The same applies to the occupational categories: we know that officials, judges, secret agents and former federal councillors are mentioned, but not how many belong to each group.

The available figure remains the aggregate one: more than 100’000 people, described as practically all federal employees. The list of professions serves to describe the variety of the group, not to establish a ranking or a specific figure for each role. The wording concerning family members is also limited: the report refers to other information relating to partners and children, without specifying what it is or how many people it concerns.

Key points

The sequence of events in the case and Akira's precedents

The service dates the cyberattack to the end of September and reports that it had already been known about for a couple of weeks. On Tuesday, articles published by the Tamedia group's outlets made its actual scope clear. The news report does not provide a precise day for the attack and does not identify the external provider affected: these are the limitations of the available chronological and operational reconstruction.

The passage concerning communication with the people affected is also documented. Regarding the payment demand, Publica has reportedly not yet informed those concerned. The report does state, however, that some people have already been targeted by attempted scams. It does not indicate how many there are or describe the technique used in the attempts.

The precedent in Switzerland

Akira has already carried out attacks in Switzerland, including against private companies. A year ago, the federal authorities urged companies not to comply with the hackers' demands. A few months later, RUAG, owned by the Confederation, had opted to pay, following Akira's attack against its US subsidiary.

This precedent offers a documented but limited comparison: it concerns RUAG and its US subsidiary, not Publica. In the case of the Confederation's pension fund, the source speaks of a ransom demand and threats of publication or sale, but does not indicate the amount requested or any decision on payment.

The material reported by the news service thus makes it possible to clarify the groups involved, the categories of data listed, the presence of a ransom demand and the precedent of RUAG. It does not, however, make it possible to add a numerical breakdown of the groups concerned, details about the external provider or further information about the attempted scams.

Source: rsi.ch