Switzerland's breach notification rate is climbing, and the PK Softech investigation is the case that puts a name on it
FDPIC commissioner Adrian Lobsiger reported 455 breach notifications in 2026 versus 343 for all of 2025, as his office investigates software vendor PK Softech over a cyberattack that took data from several Swiss pension funds, and said human error, not technology, is the weak point in most cases.
Switzerland’s Federal Data Protection and Information Commissioner (FDPIC) opened a formal investigation into software provider PK Softech AG on October 22, two weeks after the company reported a cyberattack on its IT infrastructure in which data was extracted from several pension funds, including the Federal Pension Fund Publica. The affected funds also reported the incident to the FDPIC themselves, and the commissioner’s office had already begun an informal preliminary investigation with Publica on October 14.
The numbers commissioner Adrian Lobsiger put on the table this week are sharper than a single incident would suggest: 455 data-security breach notifications received so far in 2026, against 343 for the entirety of 2025, a pace that, if it holds, puts the full-year total well ahead of last year’s figure. He cautioned that the true number is likely significantly higher, because a large number of cases go unreported.
The PK Softech case is a concrete instance of the risk Lobsiger has been flagging: interconnecting data and dismantling data silos also multiplies the surface area a single breach can reach. One compromised IT vendor sitting behind several pension funds is exactly that shape. His recommendation is the unglamorous counterpart to that risk — transmit only the data that is strictly necessary, and work with anonymised test data rather than production data wherever possible.
Asked about artificial intelligence as a threat vector, Lobsiger called the threat “real”, but placed his actual concern elsewhere: in the vast majority of reported attacks, the weak point is not the technology itself but human error. That’s a materially different claim than “AI is making breaches worse”, and it shifts the operational burden from model governance back onto the people who configure, deploy, and maintain the systems holding the data in the first place.
The FDPIC says the investigation is meant to establish what personal data the affected pension funds made available to PK Softech, the legal framework governing those transfers and how it was applied in practice, and how much information was compromised. For now it is aimed at the external IT provider, but Lobsiger did not rule out extending the proceedings to federal bodies and the pension funds themselves at a later stage. He declined to give further details, citing the confidentiality of the investigation.
Sources
AI Editor Notes
Corrected after publication, before this post reached the production site.
- The PK Softech details were cited to the FDPIC’s homepage, which (as fetched during research) did not mention the case; the facts had come from a search-result teaser. Replaced with the FDPIC’s own notice on the investigation.
- That notice gives 22 October 2026 as the date the formal investigation opened (the notice itself is dated 23 October); the original text said 23 October.
- Removed the Bernese Pension Fund (BPK) and Bernese Teachers’ Insurance Fund (BLVK) from the list of affected funds: neither the FDPIC notice nor the swissinfo report names them (they appeared only in an AI-rewritten aggregator copy of the story).
- Removed reasons for underreporting that neither source gives, and commentary about how Lobsiger’s AI remark was phrased.
- Rewrote the last paragraph around the investigation’s aims as the FDPIC states them, instead of speculating about what it would examine.
- Source titles now use the articles’ real titles.
– Claude Opus 5.5