Ok, some important context for non-Swedes.
Anyone can get access to all Swedish (non-protected but those are a very VERY small subset) personal identification numbers by simply signing an agreement with SPAR[1] (the Swedish national people database). Identification numbers per se are not particularly useful or hard to get, they are effectively public information. Using SPAR you can also get the home (and any additional) addresses of individuals
A Swedish citizen database is... you know. fun. But not exactly hard to get hold of.
I think this is good to highlight for non-Scandinavians.
Scandinavian countries are extremely open and transparent in a way that might be shocking for Americans. For example, in Norway, I can check nearly anyone's brokerage account holdings, addresses, phone numbers, etc. on public websites. I can in theory look up anyone's tax filings.
Personal identification numbers do not tend to be considered private in the same way that social security numbers in the US are.
The US used to be more this way. Not brokerage accounts as far as I recall, but whether you own a house, how much you paid for it, your address, phone number, even your SSN didn't used to be considered very private, people had it printed on their personal checks, and schools used it as a student ID number.
Newspapers used to publish hospital admissions and discharges, nothing medical but names and dates. Probably a lot of other stuff I'm forgetting.
Out of curiosity how do you authenticate yourself with government services and finance companies and such? The reason the SSN is considered private is because it's used for authentication. Usually an SSN + one or two pieces of trivially obtainable information is enough to sign up for just about anything in somebody else's name, unless physical documents are required as in the case of a passport.
I heard a rumor that some people use this to check their neighbour's revenue and sometimes make snark comments if one of them has a high revenue but lives in a "average revenue" part of town.
They'd say that if you earn a lot, you shouldn't take a cheap housing.
And then there are widespread amounts of identity theft and mapping out of minorities, but you may sleep well as everyone knowing where you do so is an important step in making sure corruption is no more, don't think too much about it.
Swedish news has some quotes from authorities that nothing of value has been leaked, and a quote from the service CGI that it only concerns test servers.[1][2]
I dont know nothing about this particular leak, but I have worked at Skatteverket.
Let me just say, the likelihood that CGI would have any _actual_ real personal data is close to 0%, at least on servers outside of Skatteverket. I had access to absolutely nothing even working inside. I have never worked in a more closed-down system, maybe excepting the swedish military "complex". No, actually that was less locked down in a way, at least once you were "inside" the system.
As a Swede this is giving me shudders, the statements reeks of paper-pushers and certification-chasers that don't seem to understand fundamental risks of how how threat actors can move around once having established footholds, hopefully there's more competent people down in the trenches.
Seeming by other sources, it wasn't really information considered PII in Sweden (but would in other places), I'm not sure this is as a big deal as people try to make it out to be.
I wonder if the focus on source code makes Swedish news slower to jump on this. I haven't seen it in domestic news yet. (Haven't looked too wide though)
I saw it on SVT a few hours ago. DN and Expressen have also reported. The details about what exactly it is that got leaked are unclear (some report it's basically the code and certs responsible for BankID SSO) but this is certainly being reported domestically.
To the best of my understanding it means that a system made by CGI for digital signing of documents (as in: you get something like a PDF from a government agency and need to digitally sign it and send it back) has had its source code and/or some data belonging to it leaked.
Skatteverket, the Swedish tax authority, has been quoted in media as confirming that they use CGI's system for digital document signing but that none of their data nor that of any citizens has been leaked.
"One of the government agencies that uses CGI’s services is the Swedish Tax Agency, which was notified of the incident by the company. However, according to the Swedish Tax Agency, its users have nothing to worry about.
“Neither our data nor our users’ data has been leaked. It is a service we use for e-signatures that has been affected, but there is no data from us or our users there,” says Peder Sjölander, IT Director at the Swedish Tax Agency."
If that is case, then it would have been wrong from the beginning for any government to keep hold of the private keys for the signature on my citizen card.
Because in that case they can sign documents on my behalf without my permission. In a court case, it would be near impossible for me to prove that the government gave my private key to someone else and that it wasn't me signing an incriminating document.
I am a Swedish citizen. Lived here for almost 40 years. It is a bit unclear to be what the "the Swedish e-government platform" is. Would have been great if they at least could have published which domain name the service has.
It's not going to be a specific service or agency with a domain name, it's going to be services that are either internal and used by employees only, or that are integrated into other systems that you may be interacting with without knowing it.
Nothing in particular, based on my understanding CGI a Swedish IT consultant company was hacked, they have contracts for and are the maintainers and developers of a bunch of various government departments IT services.
Some other comments mention BankID private keys . That would be the biggest disaster as that’s what everyone uses to identify themselves “securely” on all government services.
– Neither our data nor our users' data has been leaked. It is a service we use for e-signatures that has been affected, but there is no data from us or our users there, says
The information that source code was leaked from a joint government e-platform is not true, according to Peder Sjölander.
– There is no such platform. I think the perpetrators in this want people to feel insecure. We feel confident that our data is safe and we have the situation under control before the tax return period opens next week.
Does anyone know if there is the source code for the Swedish Armed Forces - Team Test [1] in the leak? It was a really fun collaborative flash-style game that got popular in my circle of friends for some reason back then.
When I started it was a big security theater. Had to develop on thin clients with no external internet access, for instance. Then they got some great people in charge that modernized everything.
Only drawback is when you quit, you have to make sure to unsubscribe from everything, hehe. When quitting a private company I was just removed from the github org. Here I was as well, but I was still subscribed to lots of repos, issues, PRs,heh.
Very cool! Do they accept external contributions, e.g. from Norwegian citizens? Also, was there any thought given to "digital souvereignty" (wondering because the repos are hosted on a US service)?
I'm also surprised that you were able to (or expected to?) use your private GitHub account for your work.
Yeah. In these cases it's not like anyone is going to spin up their own instance and start competing with you.
Government / handles society-critical things code should really be public unless there are _really_ good reasons for it not to be, where those reasons are never "we're just not very good at what we're doing and we don't want anyone to find out".
Similarly taxpayer funded contracts for any type of infrastructure (obviously I have digital infrastructure powered by proprietary solutions in mind) should only be awarded if interoperability is guaranteed to prevent lock-in and abuse.
"Fireproof file rooms and cabinets in the 1920s were crucial for protecting business and government records during the rapid expansion of the industrial era. The era saw a massive shift from flammable wooden office furniture to robust, steel-based storage designed to resist both fire and water damage."
That's a Google AI summary - but I've been in a fair number of buildings with such rooms. Thick concrete walls, heavy steel fire doors, no other openings, nothing but steel file cabinets in 'em, sealed electric light fixtures that look like they belong in a powder magazine (where one spark could kill everyone) - it's really simple tech.
And "high ground" was a reliable flood protection tech several centuries before that.
CGI has a lot of consultants in both government and municipal places (i've worked at both), and some of our main tools like time reporting was built as a addon to our personnel system by consultants at CGI. half my team are consultants from CGI, 4 out of 7 people.
also: hi tavro! it's been a few years, how have you been :D
This keeps happening in Europe with these mega-IT suppliers repeatedly getting exposed using very bad development practices. Sweden most recently had a major breach back in 2024 when the other large IT services supplier TietoEvry had their data centres breached and claimed "not actually an issue of security".
Several government organisations / regional authorities and companies were down. Last I heard several medical journals for whole municipalities were just destroyed.
Unfortunately, the public tender process encourages awarding contracts to these giants that repeatedly fail to deliver on even basic opsec and still believe in security-by-obscurity, are suspicious of things like zero-trust, follow outdated engineering practices. Sigh.
The tender process is what they are optimised for. They are professional project bidders with a bit of outsourced software development bolted on the back.
> Unfortunately, the public tender process encourages awarding contracts to these giants that repeatedly fail to deliver on even basic opsec and still believe in security-by-obscurity
So what you think would be the solution ? From what I see (both public tender or not), I would claim that "any large IT project/company will suffer from security issues", so not sure what is the added value to single out a process (the tender) or a region (Europe) if there is no obvious alternative.
I have (the start of a) solution, but it's a boring one:
You have to have people who care about this stuff.
If you don't care, the rest does not matter. It does not matter if, when and how you outsource if you don't care about the outcome. You can't just pay someone a salary, nor a consulting bill, check the box and say you've done your part.
And the other way around: These huge consulting conglomerates would get very few jobs if purchasers cared about the details, and not just that all the boxes are checked.
Split giant projects into small ones, award it to better smaller companies, require interoperability via API that is clearly documented and ask for around the clock security monitoring and patching. The last things being the same thing you do at any decent private company.
IBM or Accenture or whoever don't need to be the only ones winning tenders.
Absolutely. One of the root causes for these terrible tender processes is a fear of in-housing competence and skill for systems.
It's the same reason major govt. IT orgs keep pushing for closed source (recently the Swedish Tax Authority was in the media for _pushing for Office 365_ as necessary for operations), out-sourced designs, big firm purchases over FOSS or real standards.
You need people that care (and they exist, even in the gigantic state orgs.) in positions to make good decisions. Right now, everything is up in the hands of nebulously defined managerial staff with none-to-doubtful technical competence.
Another recent case: the Swedish digital exams platform flopped at a rough cost of a billion SEK. Can't sustain 150K concurrent users, despite paying a "large company". Like, come on.
Germany has iirc liability for the entire chain (engineers to upper management) in case of data breaches. I remember having to sign for that when I did a project in Germany. Would that help? I would not mind if the CEO/CTO of Odido would spend a couple of years in a federal pound them in the ass prison if it is found out the leak was due to malpractice.
The probleme here is that what tends to happen is that the security requirements are relatively vague and once the customer has signed the acceptance, good luck.
And signing up with a big company is good way to cover your behind, because "if they with all their people and knowledge could not do it...". Basically the mantra or "Nobody was ever fired for buying Cisco".
I see comments about Swedish personal identification numbers. But the article is about source code that's leaked, not a database of numbers, right? I was thinking: should government source code not be open source anyway?
The same attackers are releasing the database of personal information separately (for a fee).
That said, Sweden takes a different approach to PII, so most of that information would have already been public. You can generally just look up any resident and their ID number and other biographical details in a public directory (among other things… their tax returns are also public records).
Worked on a similar platform. The real risk isn't the code - it's the config files. Government deployments have hardcoded staging credentials, VPN endpoints, and encryption keys that don't get rotated when code leaks. Source is whatever. Those env files are the skeleton key.
Knowing swedish people's mindset I'm not surprised at all by the breach. What can be mildly surprising is that no major e-gov service has expressed concerns on their websites. Only on skatteverket.se, which is Swedish Tax Service website, there is a vague note on "maintenance work" planned for coming Saturday. Maybe totally unrelated though.
Few years ago a huge NRA database was left public with admin/1234 or similar by the Bulgarian NRA. They government fined itself some non-trivial amount, then in the source/destination IBAN they put the same value and paid the fine. They managed to find someone to blame and it was not the person who left the database but the person who found it. Turns out that if you leave the PII of a whole country open to the public it is not your fault and you get to keep your cozy job. It is already unlawful to access that, so if someone access it - it is his fault - he broke the law.
Edit, i checked the facts: The Bulgarian government said that the it should pay too much to itself, and appealed the fine for few years until it somehow expired. And the guy (20 year at that time) they accused was later acquitted after they tried to ruin his life.
As the attack actor now has the data, they're liable for ongoing GDPR failures, on top of the theft. Then anyone they sell the data to becomes liable (on top of handling stolen goods). Could be a money-earner for the EU if they pursue it properly.
Ok, some important context for non-Swedes. Anyone can get access to all Swedish (non-protected but those are a very VERY small subset) personal identification numbers by simply signing an agreement with SPAR[1] (the Swedish national people database). Identification numbers per se are not particularly useful or hard to get, they are effectively public information. Using SPAR you can also get the home (and any additional) addresses of individuals
A Swedish citizen database is... you know. fun. But not exactly hard to get hold of.
[1] https://www.statenspersonadressregister.se/master/start/engl...
I think this is good to highlight for non-Scandinavians.
Scandinavian countries are extremely open and transparent in a way that might be shocking for Americans. For example, in Norway, I can check nearly anyone's brokerage account holdings, addresses, phone numbers, etc. on public websites. I can in theory look up anyone's tax filings.
Personal identification numbers do not tend to be considered private in the same way that social security numbers in the US are.
We're so open, we even leak our government source code _ourselves_ https://github.com/navikt
5 replies →
The US used to be more this way. Not brokerage accounts as far as I recall, but whether you own a house, how much you paid for it, your address, phone number, even your SSN didn't used to be considered very private, people had it printed on their personal checks, and schools used it as a student ID number.
Newspapers used to publish hospital admissions and discharges, nothing medical but names and dates. Probably a lot of other stuff I'm forgetting.
What's the point of making public how much each person owns? Aside from making you a prime target for kidnappings and targeted advertising?
3 replies →
All email conversations in Swedish public institutions are basically a public act and any citizen can request an extract of them.
Out of curiosity how do you authenticate yourself with government services and finance companies and such? The reason the SSN is considered private is because it's used for authentication. Usually an SSN + one or two pieces of trivially obtainable information is enough to sign up for just about anything in somebody else's name, unless physical documents are required as in the case of a passport.
1 reply →
I heard a rumor that some people use this to check their neighbour's revenue and sometimes make snark comments if one of them has a high revenue but lives in a "average revenue" part of town.
They'd say that if you earn a lot, you shouldn't take a cheap housing.
Any truth to that?
22 replies →
And then there are widespread amounts of identity theft and mapping out of minorities, but you may sleep well as everyone knowing where you do so is an important step in making sure corruption is no more, don't think too much about it.
17 replies →
How do they have handle identity thefts, spams, etc.?
There are so many ways to misuse these data. Are the residents not concerned about this?
28 replies →
Not open but stupid, IMHO.
Identification numbers per se are not particularly useful or hard to get, they are effectively public information
They are absolutely trivial to get. One click on mrkoll.se.
> by simply signing an agreement with SPAR
But that seems like a completely different thing than a nefarious and anonymous person or group having access to the entire database.
Yeah, nefarious or anonymous people have never used the internet so they could never find out that this was all public information.
9 replies →
That might be interesting but it’s also completely irrelevant since no PII was actually leaked.
Also, no source code of ”Swedish e-government services” was leaked since that is not a thing:
https://news.ycombinator.com/item?id=47363966
Swedish news has some quotes from authorities that nothing of value has been leaked, and a quote from the service CGI that it only concerns test servers.[1][2]
[1]: https://www.svt.se/nyheter/inrikes/uppgift-statlig-it-inform...
[2]: https://www.cgi.com/se/sv/news/cybersakerhet/cgi-informerar-...
I dont know nothing about this particular leak, but I have worked at Skatteverket.
Let me just say, the likelihood that CGI would have any _actual_ real personal data is close to 0%, at least on servers outside of Skatteverket. I had access to absolutely nothing even working inside. I have never worked in a more closed-down system, maybe excepting the swedish military "complex". No, actually that was less locked down in a way, at least once you were "inside" the system.
As a Swede this is giving me shudders, the statements reeks of paper-pushers and certification-chasers that don't seem to understand fundamental risks of how how threat actors can move around once having established footholds, hopefully there's more competent people down in the trenches.
Are we allowed to vibe code some positive changes and submit them for review?
The source code is the least of it! From the article:
> citizen PII databases and electronic signing documents were also collected but are being sold separately
Yeah the source code isn't really such a big deal aside from helping to find vulnerabilities. The PII is a real disgrace.
Seeming by other sources, it wasn't really information considered PII in Sweden (but would in other places), I'm not sure this is as a big deal as people try to make it out to be.
Man, you've got to be a real low-life to sell all of that.
You've got to be a real low-life to collect all of that and put it in a database that is not air-gapped.
13 replies →
Encryption keys are mentioned as well.
I wonder if the focus on source code makes Swedish news slower to jump on this. I haven't seen it in domestic news yet. (Haven't looked too wide though)
I saw it on SVT a few hours ago. DN and Expressen have also reported. The details about what exactly it is that got leaked are unclear (some report it's basically the code and certs responsible for BankID SSO) but this is certainly being reported domestically.
7 replies →
What does "electronic signing documents" mean? Keys used for signing? Or merely some documents that were signed with electronic signing?
To the best of my understanding it means that a system made by CGI for digital signing of documents (as in: you get something like a PDF from a government agency and need to digitally sign it and send it back) has had its source code and/or some data belonging to it leaked.
Skatteverket, the Swedish tax authority, has been quoted in media as confirming that they use CGI's system for digital document signing but that none of their data nor that of any citizens has been leaked.
https://www.svt.se/nyheter/inrikes/uppgift-statlig-it-inform...
"One of the government agencies that uses CGI’s services is the Swedish Tax Agency, which was notified of the incident by the company. However, according to the Swedish Tax Agency, its users have nothing to worry about.
“Neither our data nor our users’ data has been leaked. It is a service we use for e-signatures that has been affected, but there is no data from us or our users there,” says Peder Sjölander, IT Director at the Swedish Tax Agency."
2 replies →
If that is case, then it would have been wrong from the beginning for any government to keep hold of the private keys for the signature on my citizen card.
Because in that case they can sign documents on my behalf without my permission. In a court case, it would be near impossible for me to prove that the government gave my private key to someone else and that it wasn't me signing an incriminating document.
4 replies →
I am a Swedish citizen. Lived here for almost 40 years. It is a bit unclear to be what the "the Swedish e-government platform" is. Would have been great if they at least could have published which domain name the service has.
It's not going to be a specific service or agency with a domain name, it's going to be services that are either internal and used by employees only, or that are integrated into other systems that you may be interacting with without knowing it.
Nothing in particular, based on my understanding CGI a Swedish IT consultant company was hacked, they have contracts for and are the maintainers and developers of a bunch of various government departments IT services.
CGI is Canadian, with global headquarters in Montreal.
I would guess that skatteverket.se, polisen.se, kronofogden.se are among those affected by the leak.
Some other comments mention BankID private keys . That would be the biggest disaster as that’s what everyone uses to identify themselves “securely” on all government services.
3 replies →
That's an interesting guess that I assume is based on absolutely nothing?
3 replies →
There is no such thing according to Peder Sjölander, IT Director at the Swedish Tax Agency:
https://www.svt.se/nyheter/inrikes/uppgift-statlig-it-inform...
– Neither our data nor our users' data has been leaked. It is a service we use for e-signatures that has been affected, but there is no data from us or our users there, says
The information that source code was leaked from a joint government e-platform is not true, according to Peder Sjölander.
– There is no such platform. I think the perpetrators in this want people to feel insecure. We feel confident that our data is safe and we have the situation under control before the tax return period opens next week.
Does anyone know if there is the source code for the Swedish Armed Forces - Team Test [1] in the leak? It was a really fun collaborative flash-style game that got popular in my circle of friends for some reason back then.
[1] https://flashism.wordpress.com/2010/03/09/swedish-armed-forc...
Maybe they should go open source from the start, then there's nothing to leak.
P.S.: And strangers will sometimes help you find vulnerabilities (and sometimes be very obnoxious but that's not open source's fault).
When I worked for the government in Norway, it slowly changed to all code being developed in the open. 3k repos here now: https://github.com/orgs/navikt/repositories
When I started it was a big security theater. Had to develop on thin clients with no external internet access, for instance. Then they got some great people in charge that modernized everything.
Only drawback is when you quit, you have to make sure to unsubscribe from everything, hehe. When quitting a private company I was just removed from the github org. Here I was as well, but I was still subscribed to lots of repos, issues, PRs,heh.
Very cool! Do they accept external contributions, e.g. from Norwegian citizens? Also, was there any thought given to "digital souvereignty" (wondering because the repos are hosted on a US service)?
I'm also surprised that you were able to (or expected to?) use your private GitHub account for your work.
1 reply →
Yeah. In these cases it's not like anyone is going to spin up their own instance and start competing with you.
Government / handles society-critical things code should really be public unless there are _really_ good reasons for it not to be, where those reasons are never "we're just not very good at what we're doing and we don't want anyone to find out".
Anything taxpayer funded should be open source to begin with.
Similarly taxpayer funded contracts for any type of infrastructure (obviously I have digital infrastructure powered by proprietary solutions in mind) should only be awarded if interoperability is guaranteed to prevent lock-in and abuse.
https://publiccode.eu
I like paper documents for this very reason.
It's very hard to steal everyone's documents when they weight about the same as a train.
But it’s also very easy to lose all of them in a fire or flood. Different tradeoffs.
> it’s easy to lose all of them in a fire or flood
Wouldn't a fire or flood affect everything? Both data stored on paper and hard disks?
2 replies →
This is a feature not a bug.
2 replies →
Problems with well-known solutions 100 years ago:
"Fireproof file rooms and cabinets in the 1920s were crucial for protecting business and government records during the rapid expansion of the industrial era. The era saw a massive shift from flammable wooden office furniture to robust, steel-based storage designed to resist both fire and water damage."
That's a Google AI summary - but I've been in a fair number of buildings with such rooms. Thick concrete walls, heavy steel fire doors, no other openings, nothing but steel file cabinets in 'em, sealed electric light fixtures that look like they belong in a powder magazine (where one spark could kill everyone) - it's really simple tech.
And "high ground" was a reliable flood protection tech several centuries before that.
2 replies →
No politician ever got elected by supporting simple, old-fashioned stuff that just worked.
CGI has a lot of consultants in both government and municipal places (i've worked at both), and some of our main tools like time reporting was built as a addon to our personnel system by consultants at CGI. half my team are consultants from CGI, 4 out of 7 people.
also: hi tavro! it's been a few years, how have you been :D
This keeps happening in Europe with these mega-IT suppliers repeatedly getting exposed using very bad development practices. Sweden most recently had a major breach back in 2024 when the other large IT services supplier TietoEvry had their data centres breached and claimed "not actually an issue of security".
Several government organisations / regional authorities and companies were down. Last I heard several medical journals for whole municipalities were just destroyed.
Unfortunately, the public tender process encourages awarding contracts to these giants that repeatedly fail to deliver on even basic opsec and still believe in security-by-obscurity, are suspicious of things like zero-trust, follow outdated engineering practices. Sigh.
The tender process is what they are optimised for. They are professional project bidders with a bit of outsourced software development bolted on the back.
A lot of outsourced development.
The tender process + clueless buyers + tender process law(s) cause this. Whole process needs a revamp for this to not be a problem.
> Unfortunately, the public tender process encourages awarding contracts to these giants that repeatedly fail to deliver on even basic opsec and still believe in security-by-obscurity
So what you think would be the solution ? From what I see (both public tender or not), I would claim that "any large IT project/company will suffer from security issues", so not sure what is the added value to single out a process (the tender) or a region (Europe) if there is no obvious alternative.
I have (the start of a) solution, but it's a boring one:
You have to have people who care about this stuff.
If you don't care, the rest does not matter. It does not matter if, when and how you outsource if you don't care about the outcome. You can't just pay someone a salary, nor a consulting bill, check the box and say you've done your part.
And the other way around: These huge consulting conglomerates would get very few jobs if purchasers cared about the details, and not just that all the boxes are checked.
3 replies →
Split giant projects into small ones, award it to better smaller companies, require interoperability via API that is clearly documented and ask for around the clock security monitoring and patching. The last things being the same thing you do at any decent private company.
IBM or Accenture or whoever don't need to be the only ones winning tenders.
2 replies →
Absolutely. One of the root causes for these terrible tender processes is a fear of in-housing competence and skill for systems.
It's the same reason major govt. IT orgs keep pushing for closed source (recently the Swedish Tax Authority was in the media for _pushing for Office 365_ as necessary for operations), out-sourced designs, big firm purchases over FOSS or real standards.
You need people that care (and they exist, even in the gigantic state orgs.) in positions to make good decisions. Right now, everything is up in the hands of nebulously defined managerial staff with none-to-doubtful technical competence.
Another recent case: the Swedish digital exams platform flopped at a rough cost of a billion SEK. Can't sustain 150K concurrent users, despite paying a "large company". Like, come on.
Germany has iirc liability for the entire chain (engineers to upper management) in case of data breaches. I remember having to sign for that when I did a project in Germany. Would that help? I would not mind if the CEO/CTO of Odido would spend a couple of years in a federal pound them in the ass prison if it is found out the leak was due to malpractice.
The probleme here is that what tends to happen is that the security requirements are relatively vague and once the customer has signed the acceptance, good luck.
And signing up with a big company is good way to cover your behind, because "if they with all their people and knowledge could not do it...". Basically the mantra or "Nobody was ever fired for buying Cisco".
I see comments about Swedish personal identification numbers. But the article is about source code that's leaked, not a database of numbers, right? I was thinking: should government source code not be open source anyway?
The same attackers are releasing the database of personal information separately (for a fee).
That said, Sweden takes a different approach to PII, so most of that information would have already been public. You can generally just look up any resident and their ID number and other biographical details in a public directory (among other things… their tax returns are also public records).
Ideally they should be open.
Worked on a similar platform. The real risk isn't the code - it's the config files. Government deployments have hardcoded staging credentials, VPN endpoints, and encryption keys that don't get rotated when code leaks. Source is whatever. Those env files are the skeleton key.
Knowing swedish people's mindset I'm not surprised at all by the breach. What can be mildly surprising is that no major e-gov service has expressed concerns on their websites. Only on skatteverket.se, which is Swedish Tax Service website, there is a vague note on "maintenance work" planned for coming Saturday. Maybe totally unrelated though.
Interesting, care to elaborate?
I'm pretty sure they did an internal analysis by 8 AM at all these places and came to the conclusion that they're OK.
Of course, they might be wrong!
Misleading title, as my first thought was "why is Sweden's egov not open source to begin with?".
Turns out it's about data.
First reaction: How come the source code is not public in the first place, accessible to every Swedish citizen? They paid for it!
But it turns out that more than the source code was leaked.
following AI corp logic that everything in the internet is open source we have a open source goverment in europe now
Most important question: do Swedish e-government services use curl?
e-government services should be open-sources by default!
Now there is an additional reason for that.
Public money, public code.
Why was all that software not open source already?
What forum is the original screenshot from? It reminds me of cs.rin.ru
Anyone knows what their tech stack looks like?
Unless they hardcode passwords and other juicy details in their source code what's all the fuzz about? It is a publicly funded thingy anyways.
As long as cronyism remains the primary qualification for leadership, nothing will ever change, worse, it's only going to get worse
Accountability now, send these people to prison
"Government surprisingly fulfills its duty by making publicly funded source code public"
How much GDPR fine will they pay? Oh wait it's gov so nothing / does no matter even if.
Who will take responsibility and get fired and lose all pension etc.? Oh wait no one.
Well the citizens need to suck it up.
Few years ago a huge NRA database was left public with admin/1234 or similar by the Bulgarian NRA. They government fined itself some non-trivial amount, then in the source/destination IBAN they put the same value and paid the fine. They managed to find someone to blame and it was not the person who left the database but the person who found it. Turns out that if you leave the PII of a whole country open to the public it is not your fault and you get to keep your cozy job. It is already unlawful to access that, so if someone access it - it is his fault - he broke the law.
Edit, i checked the facts: The Bulgarian government said that the it should pay too much to itself, and appealed the fine for few years until it somehow expired. And the guy (20 year at that time) they accused was later acquitted after they tried to ruin his life.
[dead]
As the attack actor now has the data, they're liable for ongoing GDPR failures, on top of the theft. Then anyone they sell the data to becomes liable (on top of handling stolen goods). Could be a money-earner for the EU if they pursue it properly.
[dead]
Is this the open source stuff everyone is talking about?