Switzerland's Federal Data Protection and Information Commissioner (FDPIC) said on Oct 23 that PK Softech AG, which builds pension administration software, reported a cyberattack on Oct 8 in which data was extracted from several second-pillar pension funds, including the Federal Pension Fund Publica. The FDPIC opened a formal investigation into PK Softech on Oct 22.

• What happened: Publica says its supplier was hit by ransomware at the end of September. The data came from the supplier's test environment, which held copies of real member data; Publica's production pension system was not affected.
• Data that may be affected (per Publica): names, dates of birth, AHV/OASI social security numbers, addresses, phone and email, salary and pension assets, marital status and partner details, and IBANs for pension recipients.
• Swiss media report the Bernese Pension Fund (BPK) and the Bernese Teachers' Insurance Fund (BLVK) are also affected. Publica says it has no sign yet of the data on the dark web.

The takeaway: production data copied into a vendor's test environment is still production data. Ask suppliers what copies they hold and require masked or synthetic test data.