Sweden is facing one of the largest data breaches in its history. The Swedish Data Protection Authority (IMY) is investigating a serious incident that hit the IT company Miljödata , a supplier serving 80% of Swedish municipalities . According to initial reports, more than 1.5 million personal profiles of citizens were leaked onto the dark web , exposing sensitive information about employees, students and public servants.
The attack and the timeline of the leak
Miljödata discovered the incident on August 25, when hackers managed to break into its systems, steal data, and demand a ransom of 1.5 Bitcoins to keep it from being made public. Although the company reacted quickly, the impact was already widespread: many municipalities in the country reported operational problems in critical services, affecting citizens in areas such as Halland, Gotland, Kalmar, Karlstad , and Skellefteå.
See also: Crowdstrike highlights increase in physical attacks on privileged users
The incident immediately mobilized CERT-SE (the national cyber-attack response team) and the police, while the IMY undertook to examine whether the data management violated the GDPR Regulation.
Data on the Dark Web – The First Revelations
According to the investigation, the stolen data includes sensitive personal information.
IMY head Jenny Bårdsaid that “the Miljödata leak means that a large part of the Swedish population has seen their personal data published on the Darknet.” She also stressed that the case raises critical questions about the security measures implemented by the country’s municipalities and IT providers.
The suspects behind the attack
Although no ransomware group initially claimed responsibility, a few weeks later the Datacarry group posted a 224MB file of stolen data on the dark web . Their website lists 12 more victims , indicating that Datacarry is actively involved in extorting public and private sector organizations.
See also: Nikkei: Data breach affects 17,000 people
The platform Have I Been Pwned confirmed that 870,000 users' details had been added to its database , a figure that corresponds to about half of that given by the Swedish authority. Analysts believe it is possible that the remaining data has not yet been made public or is being privately circulated on the dark web.
Who is being investigated and why?
IMY's investigation is initially focusing on Miljödata, to determine whether there were shortcomings in security measures and data management policies. The municipalities of Gothenburg, Älmhult and Västmanland County, which use the company's services, are also being audited.
Particular emphasis is placed on data of children, protected persons and former employees who may be retained in the systems without reason. The authority states that its aim is not only to punish, but to draw lessons to prevent similar incidents in the future.
The importance of the case for Europe
The Miljödata case has also raised concerns in other European countries, as it highlights the risks of centralizing municipal data with a single provider. Sweden was considered a model of digital governance, but this attack reveals that the cyber resilience of many local authorities remains limited.
Analysts point out that financial extortion small-scale, such as 1.5 Bitcoin ransoms, are becoming increasingly common, as hackers target companies with moderate security but critical to the functioning of the state.
See also: Open VSX: Addresses Token Leaks and Malicious Extensions
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
What should organizations do?
Cybersecurity experts recommend that organizations implement:
- multiple layers of authentication (MFA),
- regular security audits,
- offline backups,
- and separation of critical databases.
Prevention, they emphasize, costs less than recovery after a cyberattack. The Miljödata case thus serves as a wake-up call for every public organization that handles citizens' personal data.
In an era where digital governance is taken for granted, this incident is a reminder that security is never a given. Sweden may have emerged from this attack scarred, but other countries can learn valuable lessons before they find themselves in the same position.
Source: www.bleepingcomputer.com
