Hackers demanded ransom from Swiss government after Publica data theft, SRF reports

How the breach unfolded

Hackers from the Akira group attacked the IT systems of PK Softech AG, a software supplier based in Basel-Country, in September. Several Swiss pension funds are among its clients, including Publica, the pension fund of the Confederation. PK Softech detected the attack at the end of September, filed a criminal complaint and informed the federal bodies, Publica and other customers, including the Pensionskasse der Stadt Zürich. In early October the Confederation confirmed that Publica had been affected through its supplier, and about 112,000 people were informed and warned about possible contact by the attackers. The stolen data includes names, dates of birth, AHV numbers, addresses, phone numbers, email addresses and marital status, along with salaries, retirement assets and details about spouses or partners.

A ransom demand surfaces

SRF reported on 10 November that Akira demanded a ransom and threatened to publish or resell the stolen data, a claim that several sources confirmed to the broadcaster. The Defence Department (VBS) reportedly knows about the extortion attempt. According to SRF, the data may include staff of the Federal Intelligence Service and the Federal Office of Police (Fedpol), some of whom work under false identities, and former federal councillors could also be affected. Cybersecurity consultant Nicolas Mayencourt, who advises authorities in extortion cases, argues that the attackers most likely placed the demand directly with the federal government.

“The conclusion is that the perpetrators deposited their ransom demand directly with the federal government.”

Publica and PK Softech both told SRF that they received no ransom demand, and PK Softech says it never contacted the attackers. Mayencourt said he sees no reason to doubt those denials.

Federal responses and denials

The Secretariat for Security Policy (Sepos), which reports to the defence department, told Keystone-SDA on 10 November that the federal government had paid no ransom. Its spokeswoman Ursina Bentele said that federal bodies involved in the incident, from several departments, were not aware of any concrete ransom demands made to them.

“Federal bodies involved in handling the incident, from several departments, are not aware of any concrete ransom demands made to them.”

Federal Council spokeswoman Nicole Lamon confirmed that the government discussed the case at its last meeting but declined to give details. The National Cyber Security Centre, which belongs to the defence department, continues to advise against paying ransoms.

Why the data has not surfaced

More than a month after the attack, no stolen data has appeared online. Mayencourt sees three possible explanations: a ransom has been paid, the data has been sold abroad, or the negotiations are being deliberately prolonged. The Federal Prosecutor's Office said more than two weeks ago that its initial investigation pointed to Akira as the perpetrator of the attack on PK Softech. The case has been folded into an existing proceeding on attacks on Swiss companies between 2023 and 2025, which Akira had claimed.

“It is not usual for it to take this long.”

Ruag's earlier ransom payment

Ruag, the federally owned armaments group, paid Akira a ransom a year ago after the group stole data from a subsidiary in the United States, contrary to federal recommendations. The company has a long record of controversy. Grenades bearing its logo turned up in Aleppo during the Syrian civil war in 2012, and hackers believed to be Russian had been stealing data from the group for over two years when this emerged in 2016. An investigation now shows that internal controls failed for years over dubious Leopard tank deals, and Ruag is claiming €51 million (CHF47 million) in damages from ten individuals.