Source code of Swedish e-government services has been leaked
darkwebinformer.com
darkwebinformer.com
A Swedish citizen database is... you know. fun. But not exactly hard to get hold of.
[1] https://www.statenspersonadressregister.se/master/start/engl...
But that seems like a completely different thing than a nefarious and anonymous person or group having access to the entire database.
Basically: obviously it's not desirable to have that full database in the hands of a malicious actor but I'm not sure it's such a big deal either. Again, it's public data by design.
https://ocindex.net/assets/downloads/2025/english/ocindex_pr...
The issue here though was whether having a full database is materially worse than relying on existing public resources. I can do identity theft all day with public resources; I don’t need a full database dump.
Scandinavian countries are extremely open and transparent in a way that might be shocking for Americans. For example, in Norway, I can check nearly anyone's brokerage account holdings, addresses, phone numbers, etc. on public websites. I can in theory look up anyone's tax filings.
Personal identification numbers do not tend to be considered private in the same way that social security numbers in the US are.
They'd say that if you earn a lot, you shouldn't take a cheap housing.
Any truth to that?
There's also the underlying current of Jantelagen (Law of Jante) https://en.wikipedia.org/wiki/Law_of_Jante
Media is also allowed to pull "top" lists like the 100 people with the most income in a city, 100 people with the most wealth in a city, etc.
Nowadays I think mostly journalists use it to pull up information about politicians and other people that are in the public spotlight. There are of course the yearly "richest people in Norway" lists in various categories.
Yeah, kind of a fake solution, request it via Ratsit or whatever and all they get to see is that someone used Ratsit, but not who actually requested it.
Same goes for criminal cases, using Krimfup or whatever just leads to the service's name "leaking", while you can use fake details to sign up for both Ratsit and Krimfup.
The points was that it added another layer of issues for immigrants because they didn't understand the neighbourhood they "should be living in" with their revenue.
This seems to me a very bad attempt to hide xenophobia.
I think a lot of "humbleness" is also enforced this way, in the US seems normal (or even some European countries) to flaunt your wealth, and others seem more or less OK with it, while in Sweden it's much more socially unacceptable to in any sort of way brag about being rich, or showing that off. Humble-richness is OK and tolerated, but flagrantly displaying your wealth among the public is generally frowned upon.
So together with that, living in a average neighborhood but have a house that sticks out as clearly "rich person's house" will gain you evil looks from your neighbors, as you're "supposed to" live in a different neighborhood where neighbors look more equal, otherwise you again stick out, which is cause for friction culturally.
Lots of culture in Sweden is less about "lets correctly solve the problem" and more "lets ensure the gaping holes aren't so visible for everyone, so we can ignore it properly".
Apparently she was in a situation where she 'owned' her house, but still paid a monthly maintenance fee to some agency. and she wasn't allowed to repaint the rooms or do any sort of repairs, but had to go through some agency, who would do it for her.
Apparently that was a neighborhood thing, but she told me of epic (and apparently fruitless) struggles of her friends' who wanted to repaint their house in a different color and install some circular windows.
But they didn't change it, because "women should be able to look up the men that they date".
Last update I heard about something being done about it was this:
https://www.regeringen.se/pressmeddelanden/2024/11/utredning...
Not sure what the current status is.
Pretty modern stack. I would start a government service using those today.
Description translated:
> This system was one of the oldest IT systems in NAV, and ran in production for 51 years, from when the National Insurance Scheme was introduced in 1967. In January 2018, Presys was put into production, which together with Pesys became the successor to DSF. At that point, DSF was also shut down. The system is written in PL/I.
It's like the Apollo 11 code, but for social services.
There are so many ways to misuse these data. Are the residents not concerned about this?
By just accepting it as a normal fact of life that you will have some random stuff ordered in your name sooner or later with an invoice you'll have to dispute. Happened to a relative of mine, police do not care unless they order things above a certain value, without a police report you cannot get free ID protection, and then you'll have to sit for a long time in phone queues trying to cancel a subscription for a streaming service or whatever they ordered while get thrown around by support reps who go "you SURE you or someone in your family didn't order this?"
You of course cannot access and empty out someone's bank account this way, you're safe in that regard. But you need to dispute the invoices as soon as possible to show that it is fradulent, so you don't end up needing to actually pay for it. Or get debt collectors after you.
So don't take this poster by their word.
Not saying it DOES NOT happen as it is a system not made for the internet. But widespread? It is not.
I am in my 30s btw so I was alive before BankID and it was a worse time. Remember my parents paid bills with paper.
https://ocindex.net/assets/downloads/2025/english/ocindex_pr...
https://swedenherald.com/article/biometric-data-to-stop-fals...
Businesses in Scandinavia and many other countries would not treat someone knowing your personal information as any evidence of identity (because it's not); having all that information is not sufficient to impersonate you there - identity theft does happen but it would require stealing or forging physical documents or actual credentials to things like bank accounts; knowing all of what your mother or spouse would know is not enough to e.g. get credit or get valuable goods in your name.
It's completely crazy to me that you can be "out of status" with the USCIS and still get a social security card and a bank account, for example.
I believe that it's really important to consider the validity of terms that are heavily adopted and pushed around and whether you should use them yourself or call them out as intellectually vapid/dishonest.
These types of laws are designed for the 1950s where there were natural barriers to acquiring and disseminating information. There is no attempt whatsoever to update them and to reduce harm caused to the average citizen today.
Visual example: https://images.ctfassets.net/b2dmfxhmyqno/1cD0YDHjd9DGZnWfjH...
Identity theft and spam still happens, just not through knowing the personal number.
1. An identification approved by the EU. You get this from the national Police. (A government agency)
2. An SSN which is your birthday and four extea digits. E.g. 1212121212 is a valid "PNR", you get this from the Tax agency
3. A bank account (you need 1 and 2)
4. A patched Android or iPhone.
5. The BankID a app from a company owner by the banks in Sweden.
6. A Certificate downloaded from your bank to you BankID App
7. A PIN to Protect the key in you BankID App.
8. Normal internet connection.
9. A camera on your phone to read QR code on Service Provider webpage for session initionation
When you sign something the app will send lots of metadata to "the Identity Provider" (BankId), e.g. how much root you have on your phone, if you run known malware, your current ip, and your phone HW info. This is used to calculate a score that you as a "service provider" (i.e. banks, government, companies) can choose to ignore (they usually do)
When you as a Customer either sign in or sign you will see a document that you sign maybe "I give you 100SEK", and who you sign that to. You enter you pin or use biometric to aprove.
(Was this better than an LLM.. Yes)
Or, if I own crypto, why should the government facilitate the work for criminals?
But maybe that shouldn't be necessary? It could also remain with the doctor, who then just approves that you should be eligible for financial help.
> But yeah, let's create second class citizens out of disabled people, great idea
You are fighting strawmen.
How can you say this (and seem to believe it)?
The Government is answerable to the public and should serve the public. But conflating the government with the public is simply bizarre, to my way of thinking.
Governments should be transparent as much as possible, yes. But that doesn't mean being necessarily transparent with sensitive information that they know about members of the public. Only with your (bizarre to me) conflation of the public with the government would this make any sense.
Financial privacy is a complicated subject, could you perhaps agree that there is a use for transparancy?
You can cross-reference this by asking your favorite LLM about it.
Even the international news have started to catch it: https://edition.cnn.com/2026/02/10/europe/crypto-linked-kidn...
The problem is that when you get a high amount migrant from very different ethnicities and cultures than you, it starts to change. Those people do not necessarily want to play the same social game as you, and you risk having structured crime networks arising.
Just like in France where those kidnappings were made by the algerian "DZ" mafia (DZ is a slang for Algeria). Or in Netherlands, with the "mocro" mafia (= Morroccan) who put a price on the royal family's head, forcing the princess sibling to leave the country[0].
In the case of Sweden, this is now the case, although that many Swedish people continue to do as if it wasn't. Don't tell me that such news happens in a "safe" country:
https://swedenherald.com/article/teenagers-in-malmo-charged-...
And I don't see why there should be transparency about how much I own, or earn. I don't want the neighbors to know about it, or feed your voyeurist pulsions. The line is thin between "social justice" and "mob violence", or discrimination, in that aspect. Which is likely to happen in a country that sterilized "socially unfit" people for a long time.
[0]: https://www.thetimes.com/world/article/dutch-princess-fled-c...
[1]:
My opinion is that opaque financial markets only benefits people with lots of money and power. Financial privacy is important here in Sweden, but having the net worth and income as public records has worked for us the last 250 years. I do not know where you come from and what society you live in. I do sense fear in your posts and that is usually a personal feeling. It might be different for us since it has been ingrained for so long.
I am talking from experience in our safe society (fact). Which obviously has severe flaws (opinion).
No, because I don't believe in income tax or capital gains tax. I do believe in government taxes but they should be made on land holdings (Georgism) and on corporate activities, not on individuals' financial status (their earnings & capital).
When we have communal contributions in other settings, your contribution is usually not a secret.
It is meant to give the tax system more legitimacy, that you don't gave to wonder if people sneak out of their contribution, you can check. It also leads to yearly debates about the tax system as the list of the richest(usually inherited) is published together with what they pay in income tax vs wealth tax.
Previously you could check up anyone anonymous. These days you have to log inn, and they get a notification. But the list of the richest and their tax contribution gets published in the newspaper.
And why not include medical data as well? The "tribe" has the right to know how much each one costs, right?
What has medical data got to do with this? You can't very well go up to a disabled person and say, hey, you cost society more money, maybe you should have been born less disabled, you cost too much, pay more. Societal safety nets exist for a reason, and how much one is compensated for equal labour as your coworker... I don't see how it's related at all to the "make the disabled pay more" eugenics argument.
Ah yeah, so you are for mob justice. "Value of their work" is a highly subjective topic, which everyone is an expert on, of course.
> Plus most of the civilised world has this thing called a "union" and "workers rights" that generally prevent your imagined scenario from happening.
Worker rights and unions don't prevent employers from setting wages freely with their employees. An employee with 0 revenue has much less negociating power if the employer knows about it.
> you cost too much, pay more
I'm pretty sure people can have envy about the disabled person earning as much as they do while he/she doesn't have to wake up in the morning. Or some disabled person would like to evolve freely in the society without having everyone know about it.
> eugenics argument
Sweden sterilized disabled and socially unfit people for a long time, until 2013, so yeah, I totally see it happening. Incidentally I have seen racial and social mappings made out of the Swedish public data in the past, so it's far from anecdotic.
It is usually those with little power that suffer when you do that, and those with a lot of power that suffer from financial openness. I ask this in the most naive way possible I think the Pandora Leak was a good thing, do you not agree?
A rich man can just (and likely should, given the comments here) leave the Swedish crab basket.
Having society obsessed with watching how their neighbor is doing is a very good way to get everyone to look away, while, in the case of Sweden, a single family owns a large part of the stock exchange.
This has also the effect of fueling envy
and allows employers to discriminate you if they see that you have side income (or if you don't).
Why make all of this fuss about RGPD if private data is in the open?
And why not include medical data as well? The "tribe" has the right to know how much each one costs, right?
Let me give an example: The local kid socker team is organizing a cup, and the parrents need to help organizing, making and selling cookies, etc. This is organized through an app, where you sign up for tasks, and everyone can see what you are commiting to contribute. The same team also have an arrangement where the(small) membership fee can be waivered if you can't afford it, or you can get help buying equipment(shoes) for your kid. This is handled by you letting the trainer know in private, and he will discretely handle it.
> But we can't protect everyone from their feelings.
We can protect ourselves from the feeling of others by not sharing this data.
> equal tasks very different salaries
Unless you are an unqualified factory worker on a line with quantifiable output, in a service economy "equal tasks" are highly subjective.
> This is handled by you letting the trainer know in private, and he will discretely handle it.
Maybe the poor kid would rather not tell the trainer that he is poor and face paternalistic attitudes? And the rich kid wouldn't be reminded all the time that he is guilty of having richer parents? Add race/migration and you'll quickly tolerate bullying because of "social reasons".
https://nordictimes.com/the-nordics/sweden/bullying-doubled-...
Maybe the poor kid would rather not tell the trainer that he is poor and face paternalistic attitudes? And the rich kid wouldn't be reminded all the time that he is guilty of having richer parents? Add race/migration and you'll quickly tolerate bullying because of "social reasons".
Newspapers used to publish hospital admissions and discharges, nothing medical but names and dates. Probably a lot of other stuff I'm forgetting.
They are absolutely trivial to get. One click on mrkoll.se.
Also, no source code of ”Swedish e-government services” was leaked since that is not a thing:
[1]: https://www.svt.se/nyheter/inrikes/uppgift-statlig-it-inform...
[2]: https://www.cgi.com/se/sv/news/cybersakerhet/cgi-informerar-...
Let me just say, the likelihood that CGI would have any _actual_ real personal data is close to 0%, at least on servers outside of Skatteverket. I had access to absolutely nothing even working inside. I have never worked in a more closed-down system, maybe excepting the swedish military "complex". No, actually that was less locked down in a way, at least once you were "inside" the system.
> citizen PII databases and electronic signing documents were also collected but are being sold separately
And if we are to believe the hacked company, it is a development environment with test data in it. That remains to be seen, but is a risky thing to lie about. If there is production data in the leak, we will surely know about it.
That's not an excuse though, any system handling data like that should be continuously reviewed and pentested by professionals. Hopefully they can show that this has been done otherwise it's just negligence.
> Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize
Being able to validate that a citizen is a citizen and their ID is valid inherently requires the system be accessible
https://www.aftonbladet.se/nyheter/a/ArvG0E/cgi-sverige-uppg...
No. CGI has nothing to do with BankID.
IMO the most credible reports suggest that the source code and data involved are related to these four services:
https://www.cgi.com/se/sv/business-process-services/e-tjanst... "Mina engagemang offers a user-friendly and flexible solution that allows your customers to manage their cases directly through a personal portal. Here, users can view, track, and interact with their ongoing cases, which enhances both transparency and efficiency in the communication process." -- some kind of ticket/case management system for gov't agencies
https://www.cgi.com/se/sv/business-process-services/elektron... "With our secure end-to-end e-ID and eSign services, we can help you streamline document and contract management, gain access to all desired e-ID issuers, and improve cost efficiency." -- this sounds like a bad thing to compromise, but is to the best of my understanding a system for digital signatures on documents, and has no relation to BankID
https://www.cgi.com/se/sv/business-process-services/e-tjanst... "Gain better control over your organization’s representatives with our easy-to-use representative registry. By automating the identification and verification of representatives, you’ll gain a clear overview and enhance the security of your processes." -- sounds like some bullshit CRUD app for managing who can "represent" a gov't agency
https://www.cgi.com/se/sv/business-process-services/e-tjanst... "SHS is Sweden’s common standard for information exchange, enabling secure and efficient communication between government agencies, businesses, and organizations." -- this might be bad if real data was leaked
These are services used by various Swedish government agencies and it's pretty bad to have even a test instance of them hacked, but let's calm down. The entire Swedish state has not been compromised here.
That's incorrect. Skatteverket used CGI for BankID-login, I don't know if they still do. I have personal experience working on a BankID-login using CGI for another company and it is still active.
Edit: I just confirmed Skatteverket still uses CGI for BankID-auth. "funktionstjanster" is CGI.
Because in that case they can sign documents on my behalf without my permission. In a court case, it would be near impossible for me to prove that the government gave my private key to someone else and that it wasn't me signing an incriminating document.
I'm familiar with electronic signatures, and I know what documents are, but I have never heard the phrase "electronic signing documents" and don't know what that is supposed to mean. What kind of documents? Documents about signing, documents that were signed, documents in the sense that files containing keys could be considered documents, or what?
You use the card reader, insert your gov-issued identification and can sign PDF papers which have legal validity since the private key from the citizen card was used.
Now imagine someone signing random legal documents with your ID for things like debts, opening companies or subscritions to whatever.
CGI is not the only supplier of these services.
Currently most Swede's use a private bank consortisum controlled ID solution for most logins and signatures.
Skatteverket, the Swedish tax authority, has been quoted in media as confirming that they use CGI's system for digital document signing but that none of their data nor that of any citizens has been leaked.
https://www.svt.se/nyheter/inrikes/uppgift-statlig-it-inform...
"One of the government agencies that uses CGI’s services is the Swedish Tax Agency, which was notified of the incident by the company. However, according to the Swedish Tax Agency, its users have nothing to worry about.
“Neither our data nor our users’ data has been leaked. It is a service we use for e-signatures that has been affected, but there is no data from us or our users there,” says Peder Sjölander, IT Director at the Swedish Tax Agency."
The best case scenario is in line with what CGI claims: these are lorem ipsum fake docs from an old git repo for a test instance of the system.
Could you, having the right private keys, impersonate some company soliciting a BankID signature?
I’m not sure what you can do with that though. You cannot steal some other ongoing signature I guess.
https://www.svt.se/nyheter/inrikes/uppgift-statlig-it-inform...
– Neither our data nor our users' data has been leaked. It is a service we use for e-signatures that has been affected, but there is no data from us or our users there, says
The information that source code was leaked from a joint government e-platform is not true, according to Peder Sjölander.
– There is no such platform. I think the perpetrators in this want people to feel insecure. We feel confident that our data is safe and we have the situation under control before the tax return period opens next week.
[1] https://flashism.wordpress.com/2010/03/09/swedish-armed-forc...
P.S.: And strangers will sometimes help you find vulnerabilities (and sometimes be very obnoxious but that's not open source's fault).
Government / handles society-critical things code should really be public unless there are _really_ good reasons for it not to be, where those reasons are never "we're just not very good at what we're doing and we don't want anyone to find out".
When I started it was a big security theater. Had to develop on thin clients with no external internet access, for instance. Then they got some great people in charge that modernized everything.
Only drawback is when you quit, you have to make sure to unsubscribe from everything, hehe. When quitting a private company I was just removed from the github org. Here I was as well, but I was still subscribed to lots of repos, issues, PRs,heh.
I'm also surprised that you were able to (or expected to?) use your private GitHub account for your work.
It's very hard to steal everyone's documents when they weight about the same as a train.
Wouldn't a fire or flood affect everything? Both data stored on paper and hard disks?
"Fireproof file rooms and cabinets in the 1920s were crucial for protecting business and government records during the rapid expansion of the industrial era. The era saw a massive shift from flammable wooden office furniture to robust, steel-based storage designed to resist both fire and water damage."
That's a Google AI summary - but I've been in a fair number of buildings with such rooms. Thick concrete walls, heavy steel fire doors, no other openings, nothing but steel file cabinets in 'em, sealed electric light fixtures that look like they belong in a powder magazine (where one spark could kill everyone) - it's really simple tech.
And "high ground" was a reliable flood protection tech several centuries before that.
We have several historic examples of records being lost in disasters, and way more recent than 100 years ago.
https://en.wikipedia.org/wiki/National_Personnel_Records_Cen...
It makes no difference that we could’ve prevented that with better building construction. We didn’t, and hindsight does not bring the records back. We should plan for the world we want but cannot ignore the world we have.
I’m not defending digital as always better or criticising physical. Like I said, different tradeoffs, meaning there are advantages and disadvantages to both, there’s no solution which is better in all situations.
I am not saying that paper is magically perfect. Nor better in every situation. I am saying that paper is far easier (than digital) to do well for use cases like a national records collection. "Correctly" may include off-site backups - whether or not your threat model includes massive earthquakes, volcanoes, bombs, special forces, EMP weapons, biological agents, civil war, radioactive fallout, or enemy occupation. Or "Management wouldn't pay for a done-right facility".
As I noted in another comment, the largest downside to paper (within such use cases), is that it is far more difficult to get political support for old-fashioned stuff that just works, compared to anything that can be sold as cool/new/high-tech. Especially when the taxpayer-funded revenue streams from selling/installing/supporting the tech create incentives clearly contrary to the taxpaper's long-term interests.
Evil people use records in evil ways, righteous people use them in righteous ways.
Again, them being perishable being a feature or a bug depends entirely on what the records hold and who is interpreting the event.
Several government organisations / regional authorities and companies were down. Last I heard several medical journals for whole municipalities were just destroyed.
Unfortunately, the public tender process encourages awarding contracts to these giants that repeatedly fail to deliver on even basic opsec and still believe in security-by-obscurity, are suspicious of things like zero-trust, follow outdated engineering practices. Sigh.
The tender process + clueless buyers + tender process law(s) cause this. Whole process needs a revamp for this to not be a problem.
So what you think would be the solution ? From what I see (both public tender or not), I would claim that "any large IT project/company will suffer from security issues", so not sure what is the added value to single out a process (the tender) or a region (Europe) if there is no obvious alternative.
You have to have people who care about this stuff.
If you don't care, the rest does not matter. It does not matter if, when and how you outsource if you don't care about the outcome. You can't just pay someone a salary, nor a consulting bill, check the box and say you've done your part.
And the other way around: These huge consulting conglomerates would get very few jobs if purchasers cared about the details, and not just that all the boxes are checked.
What?! Preposterous! How could you even make money out of that? No no no, that will not do. You will ask your AI agent some vague question, commit the result without review and push it to the client. And you’ll like it. If there’s any trouble, call Timothy, he’ll be on vacation with his family in Thailand. Some resort, “Lotus” something or other.
IBM or Accenture or whoever don't need to be the only ones winning tenders.
Maybe there would be a benefit from having less layers of management, but multiple small companies or one big could have the same structure.
Waiting for my coffee now, I had a thought: what if you have more than one company providing the same service and for a project “lifetime” of say 5 years, the money is split procentually by what company attracts the more users and you make it so that for the services offered through this you can only use one company, but you can switch at anytime.
It's the same reason major govt. IT orgs keep pushing for closed source (recently the Swedish Tax Authority was in the media for _pushing for Office 365_ as necessary for operations), out-sourced designs, big firm purchases over FOSS or real standards.
You need people that care (and they exist, even in the gigantic state orgs.) in positions to make good decisions. Right now, everything is up in the hands of nebulously defined managerial staff with none-to-doubtful technical competence.
Another recent case: the Swedish digital exams platform flopped at a rough cost of a billion SEK. Can't sustain 150K concurrent users, despite paying a "large company". Like, come on.
And signing up with a big company is good way to cover your behind, because "if they with all their people and knowledge could not do it...". Basically the mantra or "Nobody was ever fired for buying Cisco".
Of course, they might be wrong!
also: hi tavro! it's been a few years, how have you been :D
That said, Sweden takes a different approach to PII, so most of that information would have already been public. You can generally just look up any resident and their ID number and other biographical details in a public directory (among other things… their tax returns are also public records).
Public money, public code.
Turns out it's about data.
But it turns out that more than the source code was leaked.
Accountability now, send these people to prison
Who will take responsibility and get fired and lose all pension etc.? Oh wait no one.
Well the citizens need to suck it up.
Edit, i checked the facts: The Bulgarian government said that the it should pay too much to itself, and appealed the fine for few years until it somehow expired. And the guy (20 year at that time) they accused was later acquitted after they tried to ruin his life.