Akira ransomware attack on Swiss federal pension fund software supplier PK Softech, Digi Mart USA News (Switzerland): The hacker group Akira reportedly obtained sensitive data in an attack on PK Softech AG, the software supplier of the Swiss federal pension fund Publica. According to research by the Swiss public broadcaster SRF, the attackers demanded a ransom and threatened to publish the data or resell it.
The Swiss Defense Department (VBS) is reportedly aware of the extortion, according to several sources cited by SRF. Federal authorities assume that potentially information about the entire federal workforce has fallen into the hands of the criminals.
This includes employees of the Federal Intelligence Service and the Federal Office of Police (Fedpol) who operate under false identities at home and abroad, which makes the stolen data highly sensitive.
PK Softech AG and Publica told SRF that they had not received any ransom demand. Nicolas Mayencourt, head of the cybersecurity firm Dreamlab Technologies, said he saw no reason to doubt the denials.
“It is likely that the attackers placed their ransom demand directly with the federal government,” he said.
The Federal Prosecutor’s Office said more than two weeks ago that the criminal group Akira was responsible for the attack on PK Softech AG, based on initial investigations. The office is incorporating the case into an existing proceeding concerning attacks on Swiss companies between 2023 and 2025, which Akira had claimed.
More than a month after the hacking attack, there is no indication that data has been published. Mayencourt said this is unusual and offered three possible explanations: the ransom was paid, Akira sold the data, or negotiations are being deliberately prolonged for tactical reasons.
He added that groups like Akira analyze stolen data to set ransom amounts and identify potential buyers, and that data capable of exposing intelligence officers is of interest to foreign intelligence services.
The Federal Office for Cybersecurity (BACS), which falls under the VBS, generally advises against paying ransoms and against contacting perpetrators, recommending that police be notified instead. The VBS confirmed that the federal government maintains this recommendation but declined to comment on how the ransom demands in the Publica case are being handled.
Officially, neither the VBS nor other federal bodies have commented on the ransom demands. SRF research indicates the hacking attack was recently discussed in the Federal Council under confidentiality.
Federal Council spokeswoman Nicole Lamon confirmed that the council discussed Publica last Wednesday and would not provide further information on the topic.
Mayencourt said he hopes no ransom will be paid, but noted that government bodies have done so several times. The state-owned defense company Ruag reportedly paid a ransom to Akira last year after an attack on its US subsidiary.
In the VBS’s earlier response to that payment, it criticized Ruag for not sufficiently considering political and reputational effects and other overriding interests.
Mayencourt warned that every payment finances the extortionists’ business model. “If it becomes known that Swiss authorities pay, the attackers are likely to intensify their efforts and seek further targets,” he said.
