Akira Hackers Reportedly Steal Swiss Federal Employees’ Pension Records

A ransomware attack on a software supplier has raised national security worries in Switzerland. The Akira cybercrime group is suspected of stealing private records of government workers. Those records could reveal undercover intelligence officers, police staff and other federal employees.

The attack hit PK Softech AG, a Swiss company that provides pension software to PUBLICA. PUBLICA is the pension fund for federal employees. Swiss authorities confirmed that the supplier suffered a cyberattack in late September 2026. The company reported the incident, and the Office of the Attorney General opened an investigation.

According to SRF, the Swiss public broadcaster, federal investigators believe the stolen data could cover employees across the whole federal government. This may include staff from the Federal Intelligence Service and the Federal Office of Police (Fedpol). Some of these workers live under false identities in Switzerland and abroad. Exposing them could create serious security risks.

Akira Reportedly Threatens to Sell or Publish Stolen Records

SRF reported on November 10 that Akira demanded a ransom after the attack. The group allegedly threatened to publish or sell the stolen information if nobody paid. However, the amount requested remains unclear. So does the identity of the party that received the demand. Similar concerns have emerged in the financial sector, where a hacker claimed to be selling 638,000 federal bank records amid unverified breach reports.

PK Softech and PUBLICA both said they had not received a ransom demand. SRF cited cybersecurity expert Nicolas Mayencourt, who suggested the hackers may have sent their demands straight to the Swiss federal government. The Swiss Defence Department confirmed it knew about the reported extortion. It declined to explain how authorities were handling the matter.

PUBLICA issued an important correction on November 10. The fund said federal authorities knew of no specific ransom demand with a stated amount or payment deadline. The software supplier did receive general extortion messages shortly after the attack. PUBLICA also said it found no sign that the stolen information had reached the dark web. Its latest update on November 11 confirmed that the investigations are still ongoing.

Data Protection Office Opens Formal Probe Into PK Softech

The Swiss Federal Data Protection and Information Commissioner opened a formal investigation into PK Softech on October 22. The inquiry aims to find out which personal records the company held. It will also check how the company handled them. Finally, it will measure how much information the attackers obtained. Authorities have confirmed that the attackers extracted data from several pension funds.

The full extent of the theft is still uncertain. PUBLICA’s earlier updates listed the records that could be affected. They include names, dates of birth, addresses, phone numbers and email addresses. Pension details and bank account information are also on the list.

PUBLICA stressed that its main pension system stayed unaffected. Members’ pension assets remain safe, and normal payments continue. Even so, the possible exposure of personal records creates other dangers. These include fraud, identity theft and targeted attacks.

Earlier RUAG Attack Adds to Swiss Government Concerns

The case also draws attention to an earlier Akira attack on a Swiss company. In June 2026, state-owned arms manufacturer RUAG confirmed that it paid a ransom. Akira had attacked its US subsidiary, RUAG LLC. The group then threatened to release stolen military-related data.

For now, the Swiss government faces hard questions about the stolen records. It must also weigh the risks to its personnel. More than a month has passed since the attack. The lack of a confirmed public leak has not eased concerns. Investigators are still working to learn what happened to the data. They also want to know whether the attackers plan to release or sell it.