Hackers and pension funds: the risk of concentration

Context

TL;DR

• FAR: approximately 20'000 beneficiaries notified after an attack
• Publica: approximately 112'000 people potentially involved
• A software provider can expose multiple pension funds in a single blow
• The scam used the French prefix 0033

Key facts

• Fondazione FAR → approximately 20'000 beneficiaries
• Publica → approximately 112'000 people potentially affected
• PK Softech → Reinach (BL), active for over twenty years
• Canton Bern pension funds → over 92'000 insured persons
• Post Office pension fund → 67'000 insured persons
• Migros pension fund → 75'500 insured persons
• Call prefix → 0033

The phone call that triggered the alarm

A pensioner from central Switzerland was called by a female voice for two days in a row. She spoke impeccable Swiss German, but the number displayed the French prefix 0033.

The pensioner is one of approximately 20'000 beneficiaries of Fondazione FAR, which finances early retirement in the construction industry. After an attack on the institution's IT partner, all beneficiaries were notified by letter.

The list also includes salary, retirement assets and partners' data. The people potentially affected number approximately 112'000, including former federal councillors.

In both incidents, the hackers did not target the pension funds directly, but rather the companies that provide their software. For Publica, the provider is PK Softech, a company from Reinach (BL) that has been active for over twenty years. Its clients include the two pension funds of the Canton of Bern, with over 92'000 insured persons, the Post Office pension fund, with 67'000, and the Migros pension fund, with 75'500.

Pension funds hold complete identities, AHV numbers, income and pension assets.

The institutions' responses differ. Publica and Fondazione FAR immediately notified the insured persons. The Post Office pension fund says the data was anonymized and that, at present, there is no need to take action; Migros is investigating. Both promise to inform any affected individuals. PK Softech is making no further statements.

Operational details

The risk lies in concentration

The most relevant element for insured persons is not only the breach of a single pension fund, but where it occurs. In the case described, the attack comes through the IT partner that supplies the software. The common provider thus becomes a point of concentration: a breach can potentially expose the data of multiple institutions in a single attack.

The difference compared with a direct attack is concrete. The pension fund may discover the problem and notify its members, but the technical perimeter also includes other clients of the same company. This is why Fondazione FAR, Publica, the Bernese pension funds, Posta and Migros appear together in the case: not because the source describes a single theft from all of them, but because the provider links multiple pension databases. The presence of the Confederation, Cantons, Posta and Migros therefore takes the case beyond a single administration or company. This distinction prevents a potential risk from being turned into an already confirmed breach.

Data that make the contact credible

If salary, retirement assets and partners' data are added, the material enables criminals to prepare more plausible communications. The source also points to a selection criterion: target the wealthiest people, often elderly and therefore more vulnerable. The problem therefore concerns the combination of the data, not just the individual telephone number. The reference to the AVS number directly concerns previdenza AVS, while salary and retirement assets show why a pension fund is an attractive target.

The institutions' different responses also produce different scenarios for insured persons. An immediate notification, such as that from FAR and Publica, informs those who may be involved. The absence of evidence declared in Bern does not rule out involvement; the anonymization indicated by Posta reduces, according to the fund, the need to act immediately; Migros' checks leave the assessment open. In all cases, being potentially involved does not amount, in the source's text, to a theft already attributed to every insured person.

Useful planning tools

To estimate your pension strategy, use the pension planner and the pillar 3 simulator.

Useful planning tools

To estimate your pension strategy, use the pension planner and the pillar 3 simulator.

Key points

A procedure based on the communications received

Anyone who receives a notice can follow a simple sequence, without confusing the levels of certainty indicated by the different institutions.

1. Read the communication from your pension fund and keep it. FAR wrote to all its approximately 20'000 beneficiaries after the attack on its IT partner. Publica notified all insured persons. These letters are the reference for understanding which incident is being reported and which data are indicated.

2. Distinguish the listed data from assumptions. In Publica's case, the source refers to data presumably stolen and lists name, date of birth, AVS number, address, telephone, e-mail, marital status, salary, retirement assets and partners' data. The list should not be turned into automatic confirmation for every person or every fund linked to PK Softech.

3. If you receive a call similar to the one received by the pensioner from central Switzerland, do not provide anything. The documented signs are a female voice, flawless Swiss German and the French prefix 0033. The pensioner had already received the notice from their fund and did not provide any data to the caller.

4. Await the institution's update. In Bern, the letters will arrive on Thursday; the fund says it cannot rule out involvement. Both have promised to inform any affected persons.

A separate check for salary

Salary is among the information potentially involved in the Publica case, along with retirement assets and partners' data. Therefore, when rereading the documentation from your fund or busta paga svizzera, it is advisable to stick to the information actually received, without attributing to a letter content that the source does not indicate.

The incident shows that the communication procedure is still ongoing: some institutions wrote immediately, one announces letters for Thursday, one currently rules out the need to act and another is checking. The most concrete course of action therefore remains the documented one: read the notice, do not provide data in response to suspicious calls and await information from the institution when it promises to contact those concerned. To complement this check with a verification of your salary, use calcolatore stipendio.

Source: tio.ch