A ransomware attack on Miljödata, a critical IT systems supplier for ~80 Swedish municipalities and major corporations, exposed the personal data of 1.5 million citizens (~15% of Sweden’s population). The breach included sensitive identifiers (e.g., SAS pilots’ details, corporate records) leaked online, enabling risks of identity theft and further cybercrimes. Authorities confirmed no ransom was paid, and the investigation by the Swedish Authority for Privacy Protection (IMY) focuses on GDPR compliance failures, outdated systems, and insufficient encryption. The incident disrupted municipal services, eroded public trust, and triggered potential regulatory fines, while highlighting systemic vulnerabilities in Sweden’s third-party IT supply chain. Recovery efforts are ongoing, with long-term operational and reputational damage expected.

A suspected ransomware attack targeted Miljödata, a Swedish software provider specializing in HR and sick leave management systems. The breach impacted approximately 200 of Sweden’s 290 municipal governments, disrupting critical operations tied to employee data—including medical certificates, rehabilitation plans, and work-related injury records. The attackers are actively extorting the company, though the full scope of compromised data and long-term consequences remain unclear as investigations continue. Swedish authorities, including CERT-SE and the National Cybersecurity Center, are coordinating response efforts, while the government has emphasized the incident’s role in accelerating new cybersecurity legislation. The attack has forced affected municipalities to seek alternative solutions, risking delays in HR and healthcare-related administrative processes.

A severe cyberattack on Swedish IT company Miljödata resulted in the theft and Darknet publication of personal data belonging to over 1.5 million individuals, including sensitive and private details. The breach, discovered in late August, exposed a significant portion of Sweden’s population, prompting an investigation by the Swedish Data Protection Authority (IMY) under GDPR compliance. The leaked data may include information on protected identities, former employees, and children, raising concerns about systemic security failures. IMY is scrutinizing Miljödata’s security protocols, data handling practices, and whether proper safeguards were in place for high-risk groups. Public sector entities—including the City of Gothenburg, Älmhult Municipality, and Region Västmanland—relying on Miljödata’s IT services are also under inspection for potential lapses in data protection. The incident underscores critical vulnerabilities in Sweden’s cybersecurity infrastructure, with IMY emphasizing the need for accountability and preventive measures to avert future large-scale breaches.

Sweden's IT systems provider Miljodata suffered a severe cyberattack over the weekend of August 23rd–24th, 2024, resulting in the leak of personal data belonging to 1.5 million individuals—nearly 15% of Sweden’s population. The compromised data, published on the dark web, included names, addresses, personal identification numbers, and contact details. The attack impacted 164 municipalities, four regional authorities, and multiple private companies, including Volvo, SAS, and GKN Aerospace, with Gothenburg employees particularly affected. A hacker group called Datacarry claimed responsibility, initially demanding 1.5 bitcoin (~$170,000) before leaking the data. While no foreign state involvement was confirmed, the breach triggered 250 reports to Sweden’s Privacy Protection Authority. The incident exposed sensitive personal information on a mass scale, raising concerns over identity theft, fraud, and long-term reputational damage for both the provider and affected organizations. Investigations remain ongoing to identify the perpetrators.

A cyberattack on Miljödata, an HR system provider used by Swedish municipalities, resulted in a massive breach exposing the personal data of over 40,000 City of Stockholm employees across 300+ occupations. The leaked information includes names, personal identity numbers, phone numbers, email addresses, and employment IDs. While the full extent of the breach is still under investigation by Truesec and law enforcement, initial reports confirm the data was accessed by an unauthorized attacker. Employees with special security protections were unaffected, as their data was stored separately.The breach mirrors a prior incident in Finland (April 2024), where attackers demanded a 1.5 Bitcoin ransom (~€143,000) to prevent data release. Though no ransom demand has been publicly linked to this attack, authorities warn of potential fraudulent misuse of the leaked personal information. The City of Stockholm has alerted affected employees about risks such as identity theft and phishing attacks, while the investigation remains ongoing to determine if additional sensitive data was compromised.