A summary for journalists and non-technical readers
A hacker stole the complete source code and configuration files from CGI Sweden's e-government platform. This is the platform Swedish government agencies use to digitally identify citizens — for example, when you log in with BankID at a government service.
Among the stolen material are master keys — secret files that make it possible to forge digital IDs. This means someone could theoretically impersonate any Swedish citizen toward all connected government agencies.
Imagine someone stole the original stamp that the tax authority uses to stamp passports. With that stamp, anyone can create fake passports that look completely genuine. That is essentially what happened here — but with digital IDs instead of physical passports.
CGI claims these were just "test servers." Our analysis shows real passwords, real keys, and real database credentials — everything needed to access production systems.
64 digital key files — at least 20 still valid (until 2027–2034). Like finding 64 keys to locked rooms, where 20 still open the door.
30+ passwords in plain text — the same password was reused for databases, email, and build systems. Like using the same key for your house, car, and office.
21 complete code repositories — the full blueprints of how the system works, including login, document signing, and data exchange between agencies.
Digital passports for government communication — certificates that prove "I am MSB" or "I am Boverket" in the secure postal system agencies use to exchange documents (SHS). Anyone with the passport can impersonate that agency.
With the stolen signing keys, an attacker can create fake logins that look completely genuine — for any Swedish citizen. On top of that, the security controls designed to catch such forgeries were turned off in the configuration.
The same password was reused across at least 8 different systems. Among those affected is the Swedish Defence Materiel Administration (FMV), whose signing keys were stored in the code repository instead of secure hardware.
National ID numbers were found in the stolen files. The hacker has advertised that citizen databases are being sold separately. There is also an SMS gateway without a password that could be used to send scam messages.
The following organizations have been confirmed in the stolen material:
At least 7 additional organizations have been identified.
The hacker goes by the name ByteToBreach and has been stealing data from airlines, banks, and government agencies in over 10 countries since June 2025. The day before the CGI leak, the same actor published a passenger database from Viking Line.
Read the full technical report:
Full technical report→For additional background, confirmations, and interview requests, contact us at pentesting.se.
This simplified report is based on passive analysis of publicly available data. No active intrusion attempts were made. Specific passwords and file paths have been intentionally omitted.
Contact: Pentesting.se / Adminor AB