What data may have been stolen from PKZH?

In the worst-case scenario indicated by PKZH, the breach may include a name, address, email address, telephone number, AHV number, marital status, information about partners, IBAN, and pension-related data such as insured income and assets. The fund is still verifying which information was stolen and how many people are involved: the complete list is therefore not presented as definitive.

Were the pension funds and annuities affected?

PKZH has announced that pension funds and pension payments were not affected. The administrative system used to manage the assets and pay out the pensions would also not have been affected by the attack. The source does not report any interruptions to benefits; the ongoing verification instead concerns the data and number of people involved.

When did the attack occur, and why was the data held by the supplier?

The cyberattack dates back to late September. Before switching to a new management system, the fund's data had been transmitted to a software provider. PKZH linked the communication to this attack and filed a criminal complaint. The fund is now reconstructing the extent of the theft.

Is the involvement of the Post Office pension fund confirmed?

No. At first, Posta's pension fund had also been mentioned, but the source specifies that its involvement has not been confirmed. Warnings appeared on its website. The text also cites the Bernese public pension fund, which in the preceding days had announced that it had been the victim of the cyberattack.

Cyberattack hits Zurich’s pension fund

Di Laura Bianchi · Published on 15 October 2026

Swiss administrative building in an urban setting, with a discreet cybersecurity cue

PKZH personal data stolen in an attack on a software provider Pension funds and annuities were not affected The attack dates back to the end of September

Context

TL;DR

PKZH personal data stolen in an attack on a software provider
Pension assets and pension payments were not affected
The attack dates back to the end of September
PKZH filed a criminal complaint

Key facts

Fund: PKZH, the pension fund of the City of Zurich
Attack: against an external software provider
When: at the end of September
Worst-case scenario: contact details, AVS, IBAN and pension data
Effects: pension assets and pension payments unaffected
Administrative system: reportedly not affected
Action: criminal complaint filed by PKZH
Verification: stolen data and affected people still to be determined

On Thursday, PKZH, the pension fund of the City of Zurich, announced that personal data of its insured members had been stolen. The cyberattack targeted an external software provider, without affecting pension assets or pension payments. The statement thus distinguishes the theft of information from the payment of benefits.

The cyberattack dates back to the end of September. Since a switch to a new management system was planned, the fund had already sent its data to the company. PKZH filed a criminal complaint. In the meantime, it is trying to determine precisely what information was stolen and how many people were affected.

Reconstructing the attack

The worst-case scenario listed by the fund includes personal contact details: name, address, email and telephone number. The same list includes the AVS number, marital status, information about partners, the IBAN number and pension data such as insured income and assets. The wording is conditional: the source does not present these categories as a list already confirmed for every person.

According to the statement, the administrative system used by PKZH to manage assets and pay pensions does not appear to have been involved in the attack. For the fund’s operations, this is therefore the limit indicated by the source. What remains unresolved, however, is reconstructing the full set of copied data and determining the number of insured members affected.

The case follows announcements from other Swiss pension funds. In the preceding days, other funds, including the public-sector fund in Bern, had announced that they had fallen victim to the cyberattack. The text does not specify which data were involved in the Bern case.

On Thursday, possible involvement by the Posta pension fund had also been raised. The source clarifies that this has not been established. Warnings appeared on its website, but this does not turn the hypothesis into a confirmation. The PKZH statement, by contrast, explicitly links the transmission of the data to the new management system project and the breach at the external provider.

Operational details

The practical implications for insured persons

For those who live or work in Switzerland and are insured with PKZH, the news has two distinct aspects: continuity of pension provision and the confidentiality of information. Regarding the former, the fund says that assets and pension payments have not been affected; the administrative system used to manage assets and pay benefits would also not have been affected. Regarding the latter, the potential leak concerns more than mere contact details, because the worst-case scenario includes an AHV number, an IBAN and pension data. The source does not report any money transfers or a suspension of pension payments. The available information concerns the theft of information.

What is certain and what remains open

Table 1: Point
Point	Confirmed or reported	Still to be clarified
Personal data	PKZH has reported a data theft	Which categories were actually taken
People affected	The fund is determining the number	How many
Assets and pensions	Funds and payments have not been affected	The complete analysis at the provider
Posta's pension fund	Involvement not established	Possible confirmation

The transition to a new management system explains why the data were held by an external company: the source says that they had been transmitted before the attack. It does not say that the system PKZH uses to manage assets and pay benefits was hit. For readers, this distinction prevents confusing a data leak with a change in pension benefits.

The reference to the other funds should also be read carefully. The Bernese public pension fund had already stated that it had fallen victim to the cyberattack, but the text does not automatically attribute the same categories of data to that case. As for Posta's pension fund, however, its involvement remains unconfirmed, despite the warnings that appeared on the website. Until PKZH completes its investigation, the number of people affected and the actual list of information stolen remain the two decisive elements.

Key points

How to follow the case without confusing the notices

The source does not describe an individual procedure involving forms, deadlines or numbers to call. It does, however, offer a sequence of checks that avoids premature conclusions.

Four steps based on the communication

1. Separate the funds involved. The confirmed case concerns PKZH. The Bernese public fund is mentioned as an already announced victim; Posta appears only with unconfirmed involvement and warnings on the website.

2. Treat the list of data as a worst-case scenario, not as individual confirmation. PKZH is verifying which information was stolen and how many people are involved.

3. Keep data and benefits separate. The communication states that pension funds and pension payments were not affected and that the administrative system would not have been affected.

4. Record the only formal act indicated: PKZH has filed a criminal complaint. This is the procedural step reported by the source; no other requirements for insured persons are described.

This scope makes it possible not to attribute instructions to the source that it does not contain. No deadline by which insured persons must respond, method of individual notification, document to send or dedicated channel is indicated. The news therefore does not make it possible to set a personal deadline.

The next verifiable element will be the outcome of the analysis launched by PKZH: which data were actually stolen and how many people are involved. Until then, the most precise distinction remains this: data theft confirmed, scope still to be determined, benefits unaffected according to the communication.

For more information about pensions, use strumento AVS/LPP/rendita.

Source: rsi.ch

Frequently Asked Questions

What data may have been stolen from PKZH?: In the worst-case scenario indicated by PKZH, the breach may include a name, address, email address, telephone number, AHV number, marital status, information about partners, IBAN, and pension-related data such as insured income and assets. The fund is still verifying which information was stolen and how many people are involved: the complete list is therefore not presented as definitive.
Were the pension funds and annuities affected?: PKZH has announced that pension funds and pension payments were not affected. The administrative system used to manage the assets and pay out the pensions would also not have been affected by the attack. The source does not report any interruptions to benefits; the ongoing verification instead concerns the data and number of people involved.
When did the attack occur, and why was the data held by the supplier?: The cyberattack dates back to late September. Before switching to a new management system, the fund's data had been transmitted to a software provider. PKZH linked the communication to this attack and filed a criminal complaint. The fund is now reconstructing the extent of the theft.
Is the involvement of the Post Office pension fund confirmed?: No. At first, Posta's pension fund had also been mentioned, but the source specifies that its involvement has not been confirmed. Warnings appeared on its website. The text also cites the Bernese public pension fund, which in the preceding days had announced that it had been the victim of the cyberattack.