I don't know how much blame you can put on IBM here.

- The Transport Agency decided to outsource operations, and IBM won the contract (April 2015)

- The following month, the head of the agency decided to ignore certain laws about privacy, secrecy, etc., as well as the agency's own requirements about information security

- The Swedish Security Service, Säpo (basically our FBI), immediately got wind of this and started investigating, ultimately recommending - in November 2015 - to put an immediate halt to the outsourcing

- The Transport Agency decided to ignore the advice of Säpo and handed over operations to IBM in December 2015

Here's a good timeline: http://www.dn.se/nyheter/sverige/detta-vet-vi-om-transportst...