Publica: A Leak Without an Exposure Map
The Swiss Federal Pension Fund Publica notice reports a leak following an incident at an unnamed software provider. Detection was placed in late September, not an independently established intrusion window. Members had been told; the affected records were still being identified with national authorities.
Its supplier made a formal crime report and alerted officials, the fund and other clients. An investigation is under way at the Office of the Attorney General. The notice supplies no exact incident or publication clock, supplier name, population, field list, method or CVE.
Verify contact before acting
A confirmed leak with an unknown data inventory calls for careful verification, not a guessed breach scenario.
BlackTree recommends verifying any incident message through the fund’s independently located channel. Do not use links or contact details inside an unexpected message. Save the notice and later updates so you can compare verified findings with any request made of you. This is a verification step, not evidence that fraud is occurring.
Ask for an evidence map
BlackTree recommends that the fund and connected organisations ask the supplier for an evidence map covering the affected service, their data flows, access identities, integrations, preserved logs, and the earliest and latest suspicious activity. It should distinguish data viewed, queried, exported and confirmed lost.
Preserving authentication, administrator, export, API and support-access logs would help investigators test that map before anyone makes exposure-specific claims. This is an evidence question set, not proof that a control failed.
Keep the boundary precise
The fund reports that the provider has no customer relationship with another federal entity. That is not a finding about unrelated incidents.
An omitted data field is not proof that it was safe. Equally, a confirmed leak does not establish credential theft, payment fraud or pension account compromise.
The responsible sequence is to verify contact, preserve evidence, publish a field-level inventory when supported, then give members actions tied to confirmed exposure.
Source: Official notice, published 8 October 2026 on SIF’s website.
