Sweden Government Hack Exposes E-Platform Source Code

Source code leaked. Swedish e-government infrastructure compromised. 10.2 million citizens potentially affected.

The sweden government hack surfaced Thursday when threat actor ByteToBreach dumped files they claimed came from CGI Sverige and Sweden’s digital government systems. The leaked data includes source code from the national e-government platform—used by 95% of Sweden’s population in 2024. That’s 10.2 million people who logged into compromised infrastructure.

Not ideal.

## What Got Taken

ByteToBreach claims they grabbed the full source code of Sweden’s e-government platform. The files could include configuration data, internal staff databases, citizen personally identifiable information, and electronic signing documents. CGI Sverige—the Swedish arm of IT giant CGI Group—confirmed two internal test servers got hit.

The company told Swedish outlet Aftonbladet that “an older application version and its source code were accessible.” Test servers. Not production. That’s the official line. But test environments often mirror production data. Security researchers know this.

CGI press secretary Agneta Hansson confirmed Swedish authorities launched an investigation. Sweden’s civil defense minister Carl-Oskar Bohlin acknowledged the sweden government hack publicly and said the government is working with CERT-SE and the National Cyber Security Center to find who did it.

## How Bad Is It?

IT security expert Anders Nilsson reviewed the leaked files. His assessment: “Source code for several programs seems to exist, and from what I can see, the hack looks genuine.” He told Swedish media outlet SVT the materials appear authentic.

Genuine source code in attacker hands creates follow-on risk. Even if production data wasn’t stolen—and CGI says it wasn’t—exposed code lets attackers map vulnerabilities. Find a weak spot in the code. Exploit it on live systems. That’s the playbook.

95% adoption rate means Sweden’s e-government platform is critical infrastructure. Citizens use it for taxes, benefits, healthcare, business registration. Digital identity. Everything runs through this system.

CGI insists “no indication that customer production data or operational services were affected.” That’s today’s assessment. Breaches often reveal more damage over time as forensics progress.

## Part of a Pattern

This sweden government hack isn’t isolated. Threat intelligence platform Threat Landscape noted ByteToBreach hit Viking Line just one day before the CGI breach. Same actor. Back-to-back Swedish targets.

“ByteToBreach is the same actor responsible for the Viking Line breach posted just one day prior, suggesting an ongoing campaign targeting Swedish and European infrastructure via CGI’s managed services footprint,” Threat Landscape said in a Thursday report.

CGI manages IT infrastructure for government and private clients across Europe. One compromised entry point—even test servers—could expose multiple clients. That’s the risk with managed service providers. You’re only as secure as their weakest deployment.

Hackers increasingly target European public infrastructure. Sweden, Norway, Finland—all saw escalating attacks in 2024. Threat Landscape warned this trend is accelerating.

## What Happens Next

Swedish authorities are investigating with CERT-SE and the National Cyber Security Center. Question is whether ByteToBreach accessed more than test servers. And whether other CGI clients face exposure.

CGI hasn’t disclosed the attack vector. How did ByteToBreach get in? Phishing? Misconfigured server? Stolen credentials? That detail matters for other organizations running similar setups.

The leaked materials haven’t been fully verified by independent researchers yet. But Anders Nilsson’s preliminary review suggests they’re real. If source code is out there, attackers will analyze it for weaknesses.

For Sweden’s 10.2 million e-government users, the immediate risk is unclear. No confirmed leak of production citizen data. But source code exposure means attackers can probe for vulnerabilities in systems millions use daily.

Sweden’s government hasn’t issued guidance to citizens yet. No password resets recommended. No service outages announced. That could change as the investigation unfolds.

All eyes on CERT-SE’s next update.