Swiss pension funds are reviewing their cybersecurity measures and relationships with software providers following a cyber attack on pension administration software provider PK Software.
Migros Pensionskasse said it is taking extensive measures to prevent cyber attacks on its systems and protect members’ data.
The pension fund works with the information security team of the Federation of Migros Cooperatives, the central services organisation of the Swiss retail group, to protect its systems against cyber threats.
Pensionskasse Post has “intensified the dialogue with the software partner and with other external partners” to assess the implications of the attack and determine whether additional measures are necessary, chief executive officer Petra Arnold Schlüssel told IPE.
The pension fund regularly reviews its information security arrangements and exposure to cyber risks, she added.
“This includes organisational, technical, and personnel-related measures,” and raising awareness among employees, Arnold Schlüssel said.
However, cyber risks can “never be entirely eliminated”, making it essential to “continuously review existing measures, prepare appropriately for potential incidents, and ensure rapid, transparent cooperation with affected partners and relevant authorities”, she continued.
Pensionskasse Post also expects external service providers and partners to maintain appropriate safeguards covering information security, data protection and operational resilience.
Meanwhile, Publica is working “intensively” with PK Software and the relevant authorities to investigate the cyber attack, while keeping members informed about the incident and taking steps to protect them against attempted fraud, a spokesperson said.
Pension funds weigh software provider relationships
Despite the incident, Migros Pensionskasse and Pensionskasse Post are not considering switching software providers.
“Our current focus is on continuously optimising our collaboration with our provider and working together to ensure that the stringent requirements for operational reliability, data protection, and cyber resilience are met,” Arnold Schlüssel said.
Replacing core pension administration software would involve significant costs, operational challenges and project risks, she added.
“Moreover, the market for pension fund software is highly specialised, with a limited number of suitable providers,” the CEO said.
However, the pension fund of the city of Zurich (PKZH) has suspended the planned implementation of a system supplied by PK Softech, originally scheduled for the beginning of 2027.
PKZH said it would continue using its existing system throughout 2027.
Publica, meanwhile, has yet to determine whether the incident will affect its future relationship with the provider.
“Once the incident has been clarified, we will draw our conclusions regarding future cooperation,” its spokesperson said.
