Cyberattack may expose data from Zurich and Swiss Post pension funds

A breach at a software provider has put sensitive pension data from Zurich and possibly Swiss Post under investigation. The attack occurred at the end of September, as Zurich prepared to move its pension fund to a new management system. Data had already been transferred when attackers struck the external provider.

Zurich has filed a criminal complaint and is working to establish what the attackers accessed or stole, as well as how many people may be affected. The city said the pension funds continue to operate and pension payments remain functional.

The incident reaches beyond one institution. Swiss Post confirmed that its pension fund used the same provider and was affected by the attack. It has not yet determined whether policyholders’ data was compromised. The disclosure follows reports that the Bern Pension Fund and the Bern Teachers’ Insurance Fund also lost data in the same campaign.

The potential exposure concerns personal and financial information held by pension institutions, making the investigation relevant to employees, retirees and beneficiaries across several Swiss regions. The available information does not establish the final scope of the breach or identify the attackers.

The worst case includes a detailed map of people’s identities, relationships and finances. Zurich’s pension fund said the potentially affected information could include names, postal addresses, email addresses and telephone numbers. Social security numbers and marital status may also be involved.

The list extends to information about partners, IBAN bank account numbers, insured income and pension assets. Investigators have not confirmed that every category was accessed. Zurich is still examining the provider’s systems to determine the precise contents of the stolen material.

For Swiss pension fund members, these records sit close to the core of everyday financial identity. An IBAN can connect a person to payments, while a social security number and pension details can help identify an individual across administrative systems. Contact information can also provide a route for targeted phishing attempts, although the source report does not say that such attempts have occurred.

Swiss Post listed similar categories as potentially affected, including names, addresses, dates of birth, social security numbers, contact details, email addresses and pension information. The two institutions have yet to publish a confirmed number of affected people.

Pension payments and fund operations continue while the forensic work proceeds. Zurich said the administrative system used to manage assets and pay pensions was not believed to have been affected. The city also said its pension funds and payments remain functional.

Swiss Post said pension assets and pension benefits are not at risk. That distinction matters for members trying to understand what the breach means in practice. The reported incident concerns data held by an external software provider. It has not been described as an attack that disrupted the payment of benefits or transferred pension assets.

The funds still face a significant administrative task. They must determine which files the attackers reached, whether the data was copied or removed, and how many current or former members appear in the affected records. They must also coordinate with the provider and investigators before issuing a complete notification.

Zurich has filed a criminal complaint. Swiss Post has acknowledged the incident and said it is assessing whether policyholders’ information was compromised. Neither institution has provided a final count of affected people in the source report.

The attack has already reached pension institutions in at least three parts of Switzerland. Zurich’s city pension funds and Swiss Post are the latest organisations named in connection with the incident. The same software provider was also used by the Bern Pension Fund and the Bern Teachers’ Insurance Fund, where data theft became public the previous week.

The pattern shows how a single supplier can connect institutions that otherwise operate separately. A provider handling data for multiple pension funds can become a high value access point, particularly during system changes when information is transferred or consolidated. The source report does not identify the provider, the attackers or the technical method used in the breach.

The affected organisations serve different groups, including city employees, Swiss Post personnel and people insured through Bern’s public sector funds. The final scale will depend on the records held by the provider and the systems attackers reached.

Swiss pension funds now face pressure to give members clear, institution specific information. They must separate confirmed facts from possible exposure while preserving evidence for the criminal investigation and protecting ongoing operations.

The next disclosure will depend on what investigators find in the provider’s systems. Zurich is trying to identify the stolen information and the number of affected people. Swiss Post is carrying out its own assessment and has not confirmed whether policyholders’ data was compromised.

Members should expect further updates from their pension fund as the investigation develops. The current information supports a clear distinction: pension assets and benefit payments remain operational, while personal and pension related data may have been exposed. The exact scope remains unresolved.

The case also places attention on how Swiss pension institutions manage external suppliers during technology changes. Zurich had transferred data ahead of a planned switch to a new management system. That timing does not establish a cause, but it explains why records were present at the provider when the attack occurred.

The institutions named in the report will need to communicate confirmed findings, explain any protective steps and tell affected individuals what action is required. Until then, members should rely on official notices from their pension fund and treat unexpected messages requesting personal information or banking details with caution.