Sweden Investigates Alleged Breach of E-Government Platform Source Code

A hacker group has claimed responsibility for leaking sensitive materials related to Sweden’s e-government platform, which has triggered a response from national authorities and CGI Sverige.

On Thursday, cybersecurity accounts on X and local outlets reported that a group identifying itself as ByteToBreach made claims of a breach involving CGI Sverige, the Swedish arm of the global IT firm CGI Group. The hack is tied to Sweden’s e-government infrastructure, as stated by local news source Aftonbladet.

CGI noted that their cybersecurity team uncovered the breach involving two internal testing servers that were not operational. While an older version of the application and its source code were found to be publicly accessible, CGI emphasized that there were no signs indicating that customer data or services were compromised. Agneta Hansson confirmed the investigation into the leak is ongoing.

According to Eurostat data, approximately 95% of Sweden’s population of 10.7 million utilized e-government services in 2024.

The leaked documents reportedly include the platform’s source code and configuration files, as well as sensitive data such as a directory of employees and citizens’ personal identification information.

News Source: Vecert Analyzer

Cointelegraph sought comments from CGI Group and Sweden’s national IT incident center, CERT-SE, concerning the leak.

Swedish Civil Defense Minister Confirms Cyber Incident

Carl-Oskar Bohlin, Sweden’s Minister of Civil Defense, has confirmed the data breach, stating that the government is collaborating with CERT-SE and the National Cyber Security Center to track down those responsible.

IT security specialist Anders Nilsson verified that the compromised resources appear authentic. “It seems that the source code for multiple applications exists, and this hack appears legitimate,” he wrote in an email to SVT.

Increased Targeting of Public Infrastructure

Hackers are increasingly attacking various public cyber infrastructure elements across Sweden and Europe, warned the Threat Landscape platform.

“This isn’t an isolated case,” the platform stated in a report released Thursday.

“ByteToBreach is the same entity behind the Viking Line breach reported just a day earlier, indicating a persistent campaign against Swedish and European infrastructure using CGI’s managed services footprint.”

The group claims to have leaked the source code of the e-government platform alongside numerous auxiliary materials. Threat researchers have indicated that the exposure poses continued risks if attackers utilize the leaked material to uncover vulnerabilities in publicly accessible systems, although the entire contents of the data dump have not been independently confirmed.