Key takeaways
-
Your data is only as safe as the weakest link in your supply chain. Swiss Pension Fund Publica wasn’t attacked directly, yet its insured members’ most sensitive personal data may now be in criminal hands.
-
Internet exposure is perhaps the greatest cybersecurity risk there is. Exploiting software vulnerabilities is now the leading way attackers get in, and third parties are involved in nearly half of all data breaches.
-
More defensive layers don’t remove the underlying problem. Firewalls and VPNs remain important, but they don’t stop critical systems from being reachable from the public Internet.
-
SCION changes the question from “how do we defend this?” to “does this need to be reachable at all?”
A recent cyberattack on a Swiss pension fund software provider has exposed a critical vulnerability: Even organizations with strong cybersecurity measures can be compromised through third parties. Here's why securing network access should be a priority for everyone involved.
A cyberattack that hits close to home
Imagine receiving a letter informing you that cybercriminals may now have access to your name, home address, salary, pension savings, and Swiss social security number (AHV).
This is NOT the kind of correspondence you want from your pension fund.
Yet this is precisely the situation that thousands of people insured through Publica, one of Switzerland's largest pension funds, now face.
In late September 2026, cybercriminals attacked PK Softech AG, a Swiss software provider specializing in pension fund applications. According to the company's official statement, the attackers used malware to gain access to part of its IT infrastructure. Sensitive personal data belonging to Publica's insured members may have been compromised.
The attack did not target Publica directly. Instead, the attackers compromised a third-party supplier entrusted with handling sensitive information.
For David Basin, a member of Anapaya’s board of directors and Professor at ETH Zurich, this isn't just another cybersecurity headline.
"I was personally affected by this breach. Knowing that my most sensitive personal information may now be in the wrong hands is unsettling. Cybercriminals potentially know where I live, how much I earn, and details about my family. What's next? And as someone who works with SCION technology, it's particularly frustrating because I know there are ways to significantly reduce the risks that make attacks like this possible."
Two cybersecurity risks with one uncomfortable reality
The Publica incident highlights two interconnected cybersecurity challenges: Internet exposure and third-party risk.
Neither issue is new, but both are huge problems. And taken together, they can turn a security vulnerability at one organization into a data breach affecting thousands of people.
1. Internet exposure: An open invitation to attackers
The Internet is indispensable to modern business. Yet the same connectivity that enables organizations to operate also gives cybercriminals opportunities to find and exploit vulnerabilities.
Internet-facing applications, remote access services, network gateways, and other exposed systems can be discovered, scanned, and targeted by attackers from virtually anywhere. Add to this that attackers are getting better at finding their way in, and Internet exposure becomes perhaps the greatest cybersecurity risk there is.
According to Verizon's 2026 Data Breach Investigations Report, exploitation of software vulnerabilities accounted for 31% of initial breach access, overtaking stolen credentials as the leading entry point.
The traditional response has been to build more layers of defense around Internet-connected infrastructure: firewalls, intrusion detection, VPNs, and other appliances.
These measures remain important, but they don't fundamentally eliminate exposure to the public Internet.
What if attackers couldn't discover or reach critical systems in the first place? With SCION, that is not a “what if” speculation anymore. It is a tried-and-true technology. So the question becomes “what are we waiting for?”
2. Third-party risk: Your suppliers' vulnerabilities become your problem
Few organizations operate independently. They rely on software vendors, service providers, IT partners, and countless other third parties to keep their operations running.
Every relationship can bring value, but depending on how systems and data are shared, it can also introduce another angle of attack.
In fact, Verizon's 2026 report found that third parties were involved in 48% of all analyzed data breaches, a 60% increase over the previous year's dataset. That's nearly half of all breaches.
In the case of Publica, the distinction between the organization and its supplier offers little comfort to those potentially affected: Their personal information may have been compromised, regardless of which company's infrastructure was attacked.
You may take your cybersecurity very seriously, but does everyone you work with hold the same standard? Trust in a supplier should not simply equate to unrestricted access.
Organizations need to understand not only who can access their networks and applications, but also which suppliers process or store their data, what access those suppliers require, and what security standards they maintain.
Protecting critical infrastructure means looking beyond your own network
Banks, healthcare providers, utilities, and other organizations supporting essential services depend on interconnected systems and external partners just as much as pension funds.
Protecting these environments requires organizations to address two sides of the same cybersecurity coin.
The first side is protecting against direct attacks. Critical systems and applications should be accessible only to authorized users and organizations, using network infrastructure designed to minimize exposure and enforce trusted connectivity.
The second side is protecting against indirect attacks. Suppliers and partners need equally robust security standards. Organizations should know who can connect to their systems, through which routes, and under what conditions. They must also assess the safeguards protecting sensitive data held by third parties.
Securing your own front door is of little use if someone can simply walk in through a side door you were not aware of.
How SCION changes the equation
SCION (Scalability, Control, and Isolation on Next-Generation Networks) approaches network security differently.
Rather than relying exclusively on defensive layers around publicly reachable infrastructure, SCION enables organizations to establish controlled network connectivity between trusted participants, reducing exposure to unauthorized network access.
Anapaya's SCION-based solutions extend this approach across different connectivity requirements, from protecting individual applications to securing communication between entire sites.
But what would that mean in a scenario like the Publica breach?
The exact technical circumstances of the attack have not been publicly disclosed , so we present two hypothetical scenarios to help illustrate where SCION-based solutions could strengthen security by taking critical systems off the public Internet.
Scenario 1: Attackers exploit an exposed application or remote access service
If attackers gained initial access through an Internet-facing service, reducing that service's public exposure could significantly limit their opportunities.
Two solutions are available using SCION technology: when users are known, applications can be protected with Anapaya PathGuard, and when users are not known, traffic to the application can be routed via Anapaya GATE.
Anapaya PathGuard protects access to critical applications by making network paths unavailable to unauthorized users. Anapaya GATE reduces the attack surface of an application by up to 99.99%.
Together with appropriate authentication and application security, these solutions can help reduce exposure to external attacks.
Scenario 2: Attackers exploit network connectivity between organizations
If an attacker compromises a supplier and attempts to use its network connections to reach a customer's systems, controlling the permitted connections becomes critical.
Anapaya EDGE, with SCION Secure Access Groups (SAG), allows businesses to establish private, invite-only connectivity between trusted sites and partners.
Only authorized participants can discover and use the network paths shared within the group.
This reduces the opportunity for unauthorized network access and enables organizations to control which partners can communicate with which parts of their infrastructure.
Importantly, neither approach replaces endpoint security, application security, access management, or measures protecting data already stored by a supplier. SCION strengthens the network layer as part of a broader security strategy.
Your cybersecurity responsibility doesn't end at your network boundary
The Publica breach is a reminder that the consequences of cyberattacks rarely remain confined to the original target; sometimes the aim of an attack IS to exfiltrate data or attack nodes by moving from system to system.
They extend to customers, employees, partners, and ordinary people who entrusted their information to organizations they had every reason to believe would protect it.
For those affected, the distinction between a direct attack and a third-party breach is ultimately irrelevant. Their data is still at risk.
For organizations with a duty to protect data, however, that distinction matters enormously.
It means looking beyond perimeter defenses, challenging assumptions about trusted suppliers, and reconsidering whether critical infrastructure needs to be reachable over the public Internet at all.
The question is no longer simply whether your own network is secure. It's whether the entire chain of connectivity protecting your critical services and information is secure enough.
And that question is worth asking before the next breach, not after it.
Especially when your answer to that question is in the negative and a solution already exists for implementation that could change it to an affirmative.
