Is Your Broker Safe? What the Publica Hack Reveals About Swiss Investment Security

The Attack That Changed the Conversation

Let’s set the scene properly. In late September, the Akira group hit PK Softech AG, an external software provider for Publica, the pension fund for federal employees. The hackers made off with about 100 gigabytes of compressed data. When unpacked, that data revealed names, birth dates, AHV numbers (Swiss social security numbers), addresses, pension balances, and even IBANs belonging to over 100,000 current and former federal employees.

The consequences are still unfolding. The Swiss intelligence service (NDB) has reportedly suspended foreign operations because agents working under false identities may have been exposed. Former federal councilors’ data is in the wind. And the federal government has set up a taskforce under Anne Rivera, the federal information security officer.

Now, here’s the critical detail most people miss: the breach didn’t happen at Publica itself. It happened at a third-party vendor, an IT company that managed data for many Swiss pension funds. The attack vector wasn’t a sophisticated zero-day exploit, it was a supply chain vulnerability.

And this is exactly what FINMA (Swiss Financial Market Supervisory Authority) has been warning about. According to the NZZ’s reporting on cybercrime acceleration, nearly half of the incidents reported by financial institutions in 2025 involved third-party providers as entry points.

The Ricardo Comparison Is Misleading

When the news broke, plenty of people on Swiss finance forums immediately drew parallels between the Publica hack and the separate breach at Ricardo, the Swiss online marketplace. But this comparison falls apart under scrutiny.

Ricardo is fundamentally a consumer platform. It’s a website with login credentials and a marketplace database. That’s not to minimize their security failures, but the threat model is entirely different from a regulated financial institution.

A licensed broker like Swissquote, Interactive Brokers, or even PostFinance operates under FINMA supervision. That means:

• Regular security audits are mandatory, not optional
• Penetration testing happens continuously
• Client assets are segregated from the firm’s own balance sheet (this is legally required)
• Capital requirements exist specifically so the company can’t just vanish with your money

One commenter on the Swiss Personal Finance forum put it bluntly: comparing Ricardo to Swissquote or IBKR is like comparing a corner kiosk to a high-security data center. They’re both buildings, sure, but that’s where the similarity ends.

That said, the security gap isn’t the only thing worth considering. Let me break down what actually matters when you’re choosing where to hold your investments.

What Actually Protects Your Securities

Here’s the part that might calm you down: your securities are held separately from the broker’s own assets. When you buy shares of Nestlé or an S&P 500 ETF through a Swiss broker, those assets are registered in your name and held in custody on your behalf. This is a legal requirement under Swiss law.

What does this mean in practice? Even if your broker goes bankrupt, or gets hacked so badly that they lose client records, your securities don’t automatically vanish. They’re tracked independently, and in the case of insolvency, the custodian bank or the Swiss Depositary & Clearing system steps in.

The flip side? A hack that compromises your personal data is a different story. Your identity, your login credentials, your address, these aren’t protected by the same segregation rules. And that’s where the real risk lies.

The Three Questions You Should Actually Ask

When you’re evaluating a broker’s security, don’t just look at whether they’ve been in the news. Ask yourself these three questions:

1. What happens if they get breached?

For Zurich Cantonal Bank (ZKB), UBS, or Swissquote, these institutions have dedicated incident response teams, cyber insurance policies, and regulatory obligations to disclose breaches to FINMA. They also have the financial resources to handle fallout.

For a smaller, less-regulated provider? The calculus shifts. And this is where the security risks of neobrokers compared to traditional banks come into play. Many neobrokers offer slick interfaces and rock-bottom fees, but their security infrastructure doesn’t always match the incumbents’.

2. How do they handle authentication?

This is a question you can actually investigate yourself. Does your broker still offer SMS-based two-factor authentication? That’s a red flag. SIM-swapping attacks are a real and growing threat.

After the Salt mobile hack earlier this year, personal data needed for call center authentication was compromised. That means attackers could potentially use social engineering on call center agents or attempt SIM swaps to bypass SMS verification.

The gold standard? Hardware-based authentication like a FIDO2 key, or at minimum app-based authenticators (Google Authenticator, etc.) that aren’t tied to your phone number.

3. What’s their track record?

Has your broker ever experienced a breach? If so, how did they handle it? Did they disclose it promptly? Did they offer credit monitoring or compensation?

A provider with a clean record isn’t necessarily safer than one that’s been tested, sometimes the opposite. A company that’s weathered an attack and improved its defenses may actually be more secure than one that’s never been tested.

Diversification: The Overlooked Safety Net

One of the most interesting debates in the Swiss investing community right now is whether to split your assets across multiple brokers. The logic is simple: if you have everything at one institution and they get breached, you have a single point of failure.

But here’s my honest take: this is overthinking it for most people.

Remember what we discussed earlier, your securities are segregated and legally protected regardless of the broker. Spreading your portfolio across five different platforms doesn’t add meaningful security if they all use the same underlying infrastructure (which many do, often through the same custody banks).

What it does add is complexity. More accounts means more login credentials to manage, more tax paperwork (Steuererklärung, or tax declaration, becomes more tedious), and more opportunities for you to make mistakes.

The exception? If you’re investing through a less-regulated or offshore platform, or if you’re dealing with a broker that isn’t covered by Swiss or EU investor protection schemes, diversification makes sense. But for Swiss-regulated brokers? Keep it simple.

The Real Risk Isn’t Where You Think

Here’s the uncomfortable truth that most articles about this topic avoid: your biggest security vulnerability isn’t your broker, it’s you.

The Publica breach is scary because it exposed data on a massive scale. But the actual harm comes from what happens next: identity theft, phishing attacks, and social engineering attempts that use your real personal information to trick you.

This is the type of financial scam that targets vulnerable groups across the DACH region, your mom getting a WhatsApp message from “her bank” with perfect details about her account, your aunt receiving a call from “Swiss police” about suspicious activity.

So here’s my practical advice, and it’s less sexy than “switch to a crypto hardware wallet” but far more effective:

1. Use unique passwords for every financial account. Yes, every single one. Password managers are your friend.
2. Enable hardware-based 2FA wherever possible. If your broker only offers SMS, email them demanding improvement, or switch.
3. Monitor your accounts regularly. Weekly checks aren’t paranoid, they’re pragmatic.
4. Be suspicious of unsolicited contact. Your bank will never call you asking for your password or a verification code. Never.
5. Freeze your credit if you’ve been affected by a major breach. The Publica hack exposed IBANs and AHV numbers, that’s everything needed for identity fraud.

The Bottom Line

Switzerland’s financial system is built on trust, and that trust has taken a hit. The Publica hack shows that even the federal government, with all its resources, can be compromised through a third-party vendor. No system is impenetrable.

But here’s what hasn’t changed: your securities are still protected by Swiss law. The infrastructure that holds your investments is still regulated, audited, and segregated. And while the threat landscape is evolving, so is the response, FINMA and the federal government are paying attention, and Swiss financial institutions are among the most resilient in the world.

The question isn’t whether you need to panic. It’s whether you’re doing the basics right. Strong passwords, proper authentication, regular monitoring, these are the habits that actually keep your money safe, regardless of what the hackers throw at Switzerland next.

Because let me tell you something: in the Swiss financial world, safe investments and market volatility have always been about managing risk, not eliminating it. Your broker’s security posture is just another factor in that equation. Choose wisely, stay vigilant, and don’t let the headlines keep you up at night.

Your portfolio will thank you.