Cyberattack: Zurich pension fund and Swiss Post hit

Context

TL;DR

• The attack on the supplier dates back to late September.
• PKZH is investigating the stolen personal data of insured persons.
• Funds and pension payments were not affected.
• For Posta, it is unclear whether the data has been compromised.

Key facts

• Vendor → external software company
• Connection → PKZH data transmitted for a new management system
• PKZH → criminal complaint filed
• Posta → attack confirmed, insured persons' data still uncertain
• Benefits → pension funds and pension benefits not at risk

The vendor at the center of the attack

A cyberattack targeting an external software vendor affected the City of Zurich's pension fund and, with the situation still unclear, Posta's pension fund. The attack dates back to late September. PKZH explained that its data had been transmitted to the vendor in preparation for the transition to a new management system.

For insured persons, the key issue is the distinction between personal data and the management of pension assets. According to PKZH, neither pension assets nor pension payments appear to have been involved. The administrative system used to manage the assets and pay pensions would likewise not have been affected by the attack. PKZH filed a criminal complaint and is reconstructing the extent of the data theft, both in terms of the information affected and the number of people involved.

In the worst-case scenario, the data leak from the Zurich pension fund would concern personal contact information, including name, address, email and telephone number. The scenario envisaged could also include the AVS insurance number, marital status and partner information, IBAN details and other pension-related information, such as insured income and assets. This description concerns the worst-case scenario, while the assessment of the actual extent of the leak is still ongoing.

Posta's pension fund also announced that it had fallen victim to the attack on the vendor. However, it is not yet clear whether insured persons' data were compromised. Potentially affected information includes pension data, contact details and email address, as well as name, address, date of birth and AVS number. Posta specifies that pension assets and pension benefits are not at risk.

The case also involves other pension funds. Last week, it emerged that data had been stolen from the Bernese pension fund and the Bernese teachers' insurance fund. The picture therefore remains mixed for now: for PKZH, investigations into the scope are ongoing; for Posta, it has not been clarified whether insured persons' data were compromised, while the communications cited confirm that the attack on the vendor affected multiple pension institutions.

Operational details

What it means for insured persons

For an insured person, the main practical point is the distinction between the possible theft of information and the security of assets. The statements do not describe the same situation for every fund: PKZH is determining the scope of the data, while Posta has not yet established whether the insured persons' data has been compromised. In both cases, however, the communication distinguishes personal data from pension benefits.

Two distinct levels

This grid avoids two errors. The first is turning PKZH's worst-case scenario into a definitive list: the fund is still determining whether any data was stolen and, if so, which data. The second is treating the compromise of Posta's data as already established: the statement leaves precisely this question open.

The content of the categories makes the differences concrete. In PKZH's case, contact details, AVS, marital status, partner, IBAN, insured income and assets belong to different levels but appear in the same worst-case scenario. For Posta, on the other hand, the notice cites name, address, date of birth, AVS, contact details, email and pension data as potentially affected information. The overlap is not enough to say that the exposure is identical.

The technical point is also clear: the attack hit the external supplier, while PKZH's administrative system, which manages assets and pays out pensions, was apparently not affected. The source therefore does not report any interruption in pension payments. It describes an assessment of the scope of the data linked to the supplier.

For those monitoring their own pension position, the practical consequence is to read each communication by fund and category: confirmed data, possible data, benefits not at risk. Reports about BPK and the Bernese teachers' pension fund broaden the scope of the attack, but the text does not provide a total number of people involved or a common list for all institutions.

Key points

How to navigate the available information

The source allows for a reading procedure, not a standard request for all insured persons. The first criterion is to understand which pension institution is mentioned; the second is to distinguish what is confirmed from what remains to be verified.

Four steps to avoid confusing statuses

1. Identify the fund. The statements concern PKZH and Posta's pension fund; the previous news item concerns BPK and the insurance fund for Bernese teachers. The status of one institution should not automatically be transferred to the others. 2. Separate what is confirmed from what is possible. For PKZH, investigations are still ongoing into the information stolen and the number of people affected. For Posta, it is not yet clear whether the insured persons' data were compromised. 3. Keep data and benefits separate. The personal and pension-related categories listed in the statements do not amount to a loss of assets. PKZH states that funds and annuity payments have not been affected; Posta says that assets and pension benefits are not at risk. 4. Recognize the formal actions already reported. PKZH has filed a criminal complaint and Posta has issued a statement about the attack. These are the official steps cited by the source; they do not by themselves establish which people are involved.

The text does not indicate a deadline for insured persons, a form, a request channel or an individual procedure to follow. Therefore, it is not possible to attribute to the source a date by which to submit an application or a definitive list of the data exposed. The questions still open are precise: PKZH must determine the information stolen and the number of people affected; for Posta, it must be clarified whether the insured persons' data have been compromised.

The most faithful reading, therefore, consists in not turning a list of the worst-case scenario into a complete confirmation and not confusing the attack on the provider with a risk to annuities. To learn more about the general topic of annuities, see rendite pensionistiche.

Source: swissinfo.ch