Sweden's E-Government Platform Faces Data Leak Amid Cybersecurity Concerns

A threat actor has reportedly leaked source code and other sensitive materials related to Sweden's e-government platform, leading to an investigation by Swedish authorities and a response from CGI Sverige. According to Cointelegraph, cybersecurity accounts and local media reported that a group named ByteToBreach claimed responsibility for publishing the material, allegedly sourced from CGI Sverige, the Swedish arm of global IT firm CGI Group, and Sweden's e-government infrastructure. CGI informed local news outlet Aftonbladet that its cybersecurity team identified an incident involving two internal test servers in Sweden, which were not utilized in production. The company noted that an older application version and its source code were accessible, but there was no evidence of any impact on customer production data or operational services. CGI's press secretary, Agneta Hansson, confirmed that authorities are investigating the leak. The leaked files may include the platform's source code, configuration files, internal staff database, citizens' personally identifiable information databases, electronic signing documents, and other sensitive data. Approximately 95% of Sweden's 10.7 million population utilized e-government services in 2024, according to Eurostat data. Sweden's civil defense minister, Carl-Oskar Bohlin, acknowledged the data leak and stated that the government is collaborating with CERT-SE and the National Cyber Security Center to identify those responsible. IT security expert Anders Nilsson confirmed the authenticity of the hacked resources, noting that the source code for several programs appears genuine. Hackers are increasingly targeting public-facing cyber infrastructure across Sweden and Europe, warned threat intelligence platform Threat Landscape. "This is not an isolated incident," the platform stated in a report, highlighting ByteToBreach's involvement in a previous breach of Viking Line, suggesting an ongoing campaign targeting Swedish and European infrastructure through CGI's managed services. Threat-intelligence researchers cautioned that the exposure could pose further risks if attackers exploit the leaked code or documentation to identify vulnerabilities in public-facing systems, although the full contents of the dump have not been independently verified.