Pension Data Is Guarded by 17 IT Staff Filling 57 Posts: the Audit of the Pension Fund Found Outdated Systems and Not a Single Security Officer

The data on citizens' pension and disability rights is kept by a department where 17 people work in 57 established posts. In the IT infrastructure and support unit, one of 13 positions is filled. An employee responsible for information security - there is not a single one. That is the picture the State Audit Office has published of the Pension and Disability Insurance Fund (PIOM).

The auditors found servers and workstations running operating systems the manufacturer no longer supports, computers without up-to-date antivirus protection, and security updates that haven't been applied since 2023. They also found weaknesses in managing user access and network protection. The fund had no approved business continuity or disaster recovery plans - in other words, a plan that says what to do if the server goes down or if someone locks the databases.

Vulnerabilities in the network equipment were identified back in 2024, but during the audit period no measures had been taken. The last IT skills training was in 2022, and the trainings planned for 2024 and 2025 never happened. In 2024, 12.39 million denars were spent on IT procurement, or 2.04 percent of the fund's expenditure excluding social benefits. A data centre, a disk system and optical switches were not procured - for lack of money.

PIOM's response came quickly and in a familiar tone. The fund says these are conditions inherited from the period before September 2024, from "unthrifty, irresponsible and neglectful management", and that the new leadership has already solved most of the problems: threat detection solutions introduced, a segmented network, backup infrastructure at a separate location, more than 100 workstations replaced and new expert staff. And most importantly: "There has been no compromise of your data, and there is none."

Maybe. But the fact that nobody broke in doesn't mean the door was locked. The audit doesn't measure whether there was an attack, but whether the fund was prepared for one - and the answer is that it wasn't. And the refrain about the chaos left behind by the predecessors is one every new government knows by heart. How many of the findings are really closed will be shown only by the next audit, not by a press release.

PIOM is not an isolated case. Previous audits found similar risks in "Moj termin", in the digitalisation of civil registers, in the financial management system used by 40 public institutions and in data exchange through the Central Population Register. A citizen cannot choose another pension fund or another civil registry. They have to hand their data to the state. So the state should at least have a full team guarding it, not 17 people in 57 posts.