Zurich pension fund hit by major data breach, PKZH warns

Expats and locals insured by the City of Zurich Pension Fund (PKZH) are being urged to remain on high alert following a major data breach. Hackers recently targeted an external software provider, likely stealing a wide range of highly sensitive personal information.

AHV numbers, IBANs & pension data exposed

The cyberattack took place in late September, and investigations are currently ongoing to determine the exact scope of the breach. While the analysis continues, the PKZH warned in a new official announcement that, in the worst-case scenario, a highly sensitive and comprehensive set of personal data has been compromised.

According to the pension fund, the stolen information could include names, dates of birth, home addresses, civil status, and details about spouses or partners.

More critically, hackers may have also obtained AHV numbers (social security numbers), bank account details (IBANs), and specific pension data, such as insured salaries and current pension balances. Both private and professional email addresses and phone numbers are also considered at risk.

Zurich pension savings & payouts remain completely secure

Despite the severity of the data breach, the PKZH has moved quickly to reassure members that pension savings and regular payouts remain entirely safe.

The breach did not occur on the fund's live infrastructure. Instead, hackers targeted PK Softech AG, an external software provider whose platform the pension fund is testing ahead of a planned system migration in early 2027. Because the exposed records were only being used within this test environment, the active PKZH administration system remains unaffected.

However, given the sensitive nature of the compromised information, the PKZH is urging all members to remain vigilant. Scammers could use the stolen details to launch targeted phishing emails, send deceptive links, or make fraudulent phone calls. The fund advises insured members in Zurich to verify any unexpected communications carefully and avoid opening suspicious links or attachments.

The PKZH has officially filed a criminal complaint, and authorities have launched an investigation.

Growing wave of cyberattacks in Switzerland

The incident at the PKZH follows a troubling series of digital security breaches across the country. 

The federal pension fund, Publica, was also hit by a data breach in September, raising broader questions about the vulnerability of third-party IT suppliers handling sensitive civic and financial infrastructure.

The issue extends well beyond pension funds. In recent weeks, state-owned aerospace supplier Beyond Gravity was hit by a targeted attack that investigators linked to China, as reported by 20 Minuten.

Meanwhile, the independent media outlet Republik announced on October 15 that hackers had stolen all subscriber records in a separate incident, although credit card details remained secure.