Loading story…
Miljödata, a major Swedish IT systems supplier serving approximately 80% of Sweden's municipalities, suffered a significant cyberattack in August that resulted in the exposure of personal data belonging to 1.5 million individuals. The attackers, identified as the Datacarry threat operation, stole sensitive information and demanded a ransom of 1.5 Bitcoin, subsequently leaking a 224 MB archive of data on the dark web. The breach affected citizens across multiple regions, including Halland, Gotland, Skellefteå, Kalmar, Karlstad, and Mönsterås, and included data from children, protected identity subjects, and former employees.
The Swedish Authority for Privacy Protection (IMY) and other state agencies, including CERT-SE and the police, launched immediate investigations into the incident, focusing on potential violations of the European Union's General Data Protection Regulation (GDPR). IMY is prioritizing its investigation on Miljödata and several municipalities, examining both the security measures in place and the handling of sensitive data. The incident has raised serious concerns about the adequacy of security controls and data management practices within Swedish public sector IT systems, prompting calls for improved safeguards to prevent similar breaches in the future.
See attribution, scope, and your downstream exposure.
5 events from the most recent confirmed update back to the earliest known activity.
Have I Been Pwned ingested a 224 MB archive attributed to DataCarry and added the Miljödata incident to its breach database. The service reported the leaked dataset contains personal information on about 870,000 individuals.
Sweden's Authority for Privacy Protection (IMY) began investigating the Miljödata cyberattack and dark web exposure for possible GDPR violations, including what personal data was stored and whether security shortcomings contributed to the breach. IMY said the exposed data may correspond to information on up to 1.5 million people.
The threat group Datacarry/DataCarry allegedly published data stolen from Miljödata on the dark web, escalating the incident from theft and extortion to public exposure of the dataset.
Following Miljödata's disclosure of the attack, Swedish police and CERT-SE started investigating because of the breach's broad impact on public-sector operations and data.
In August 2025, Swedish municipal IT supplier Miljödata was hit by a cyberattack in which attackers stole data and demanded 1.5 Bitcoin to prevent its release. The incident also caused operational disruptions across multiple Swedish regions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Volvo North America reported a data breach affecting its employees after a ransomware attack targeted its third-party human resources software provider, Miljödata. The incident began on August 20, 2025, when Miljödata was compromised by the ransomware group DataCarry, which later claimed responsibility and published stolen data on its Tor leak site. Miljödata discovered the attack on August 23, 2025, and after an internal investigation, determined on September 2, 2025, that Volvo Group North America employee data had been impacted. The breach exposed sensitive personal information, including names and Social Security numbers, of current and former Volvo employees. According to notifications sent to affected individuals, Volvo’s own systems were not directly compromised; the breach was limited to data managed by Miljödata. The affected HR systems are used for managing medical certificates, rehabilitation, and work-related injury reporting, and the attack impacted at least 25 organizations, including major companies and hundreds of Swedish municipalities. The total number of affected Volvo employees has not been officially disclosed, but reports suggest it could be several thousand. The data breach notification service Have I Been Pwned indicated that the overall leak from Miljödata involved data from 870,000 accounts, though not all were necessarily Volvo employees. Impacted individuals are at risk of identity theft or fraud due to the exposure of their Social Security numbers. In response, Miljödata engaged cybersecurity experts, enhanced its hosted environment’s security, and is working to prevent future incidents. Volvo notified the Massachusetts Attorney General about the breach, fulfilling regulatory requirements. The breach highlights the risks associated with third-party vendors and the potential for widespread impact when such providers are compromised. Other organizations affected by the Miljödata attack include Scandinavian airline SAS and mining company Boliden. The incident underscores the importance of robust vendor risk management and timely breach notification procedures. DataCarry’s publication of the stolen data increases the urgency for affected individuals to monitor for misuse of their personal information. The breach has drawn attention to the need for improved security controls in HR software platforms used by large enterprises. Volvo’s transparency in communicating the breach to employees and authorities is a critical component of its incident response. The event serves as a reminder of the cascading effects a single ransomware attack on a service provider can have across multiple industries and organizations.
Jun 29, 2026
Latvia’s Road Traffic Safety Directorate (**CSDD**) confirmed that attackers stole historical payment receipt data affecting more than **1.2 million people** and **200,000 businesses and legal entities**, making it one of the country’s largest reported public-sector data breaches. Exposed records reportedly included personal or company identification numbers, vehicle license plate numbers, payment amounts and dates, names, and some registered address information tied to service interactions, while officials said usernames, passwords, phone numbers, and email addresses were not compromised. Latvian authorities said the intrusion was a targeted, technically sophisticated attack that exploited an internet-exposed vulnerability in a CSDD system, and CERT.LV indicated mandatory cybersecurity requirements had not been fully met. The breach prompted criminal proceedings, investigations by cybersecurity and data protection authorities, and sharp political fallout: President Edgars Rinkevics and lawmakers called for accountability, CSDD’s supervisory board resigned, and agency chief Aivars Aksenoks said he would step down after response work concludes. Prime Minister Andris Kulbergs described the incident as a national security issue, said foreign involvement could not be ruled out, and criticized delays in notifying the government.
Aug 20, 2026
Svenska kraftnät, Sweden’s state-owned power grid operator, confirmed a data breach after the Everest ransomware group claimed responsibility for stealing approximately 280 GB of internal data. The incident was limited to an external file transfer system and did not impact the country’s electricity supply or mission-critical systems. The company is collaborating with police and national cybersecurity authorities to assess the scope of the breach and determine what information may have been exposed, while refraining from attributing the attack until further confirmation is available. Everest threatened to publish the stolen data unless its demands were met, posting the claim on its leak site. The group has previously claimed responsibility for attacks on other major organizations, though these claims have not always been independently verified. Svenska kraftnät’s Chief Information Security Officer emphasized that immediate action was taken and reassured the public that the electricity supply remains unaffected. The investigation is ongoing, and the company has not commented on the perpetrators or their motives at this stage.
Jul 12, 2026