It's something akin to a service provider in SAML parlance, if we are to believe reporting. How can it be air-gapped?
And if we are to believe the hacked company, it is a development environment with test data in it. That remains to be seen, but is a risky thing to lie about. If there is production data in the leak, we will surely know about it.
That's not an excuse though, any system handling data like that should be continuously reviewed and pentested by professionals. Hopefully they can show that this has been done otherwise it's just negligence.
And it's pretty clear to me that they were criticizing storage of sensitive data in a database that isn't properly secured and they simply misused the term "airgapped". The database in question was easily accessible from poorly maintained development infrastructure.
> Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize
If you can't implement it securely then perhaps such an undertaking wasn't a good idea? In the vast majority of cases I don't see why PII ever needs to be available over the network for remote queries. For the purpose of verification isn't it sufficient to verify hashes or better yet to attest via smartcard?
Seeming by other sources, it wasn't really information considered PII in Sweden (but would in other places), I'm not sure this is as a big deal as people try to make it out to be.
I wonder if the focus on source code makes Swedish news slower to jump on this. I haven't seen it in domestic news yet. (Haven't looked too wide though)
I saw it on SVT a few hours ago. DN and Expressen have also reported. The details about what exactly it is that got leaked are unclear (some report it's basically the code and certs responsible for BankID SSO) but this is certainly being reported domestically.
some report it's basically the code and certs responsible for BankID SSO
No. CGI has nothing to do with BankID.
IMO the most credible reports suggest that the source code and data involved are related to these four services:
https://www.cgi.com/se/sv/business-process-services/e-tjanst...
"Mina engagemang offers a user-friendly and flexible solution that allows your customers to manage their cases directly through a personal portal. Here, users can view, track, and interact with their ongoing cases, which enhances both transparency and efficiency in the communication process." -- some kind of ticket/case management system for gov't agencies
https://www.cgi.com/se/sv/business-process-services/elektron...
"With our secure end-to-end e-ID and eSign services, we can help you streamline document and contract management, gain access to all desired e-ID issuers, and improve cost efficiency." -- this sounds like a bad thing to compromise, but is to the best of my understanding a system for digital signatures on documents, and has no relation to BankID
https://www.cgi.com/se/sv/business-process-services/e-tjanst...
"Gain better control over your organization’s representatives with our easy-to-use representative registry. By automating the identification and verification of representatives, you’ll gain a clear overview and enhance the security of your processes." -- sounds like some bullshit CRUD app for managing who can "represent" a gov't agency
https://www.cgi.com/se/sv/business-process-services/e-tjanst...
"SHS is Sweden’s common standard for information exchange, enabling secure and efficient communication between government agencies, businesses, and organizations." -- this might be bad if real data was leaked
These are services used by various Swedish government agencies and it's pretty bad to have even a test instance of them hacked, but let's calm down. The entire Swedish state has not been compromised here.
That's incorrect. Skatteverket used CGI for BankID-login, I don't know if they still do. I have personal experience working on a BankID-login using CGI for another company and it is still active.
Edit: I just confirmed Skatteverket still uses CGI for BankID-auth. "funktionstjanster" is CGI.
OK, let me rephrase that: CGI, while they may "have something to do" with BankID in the sense that they have developed systems that integrate with it, does not itself develop BankID and does not hold any private keys for BankID.
If that is case, then it would have been wrong from the beginning for any government to keep hold of the private keys for the signature on my citizen card.
Because in that case they can sign documents on my behalf without my permission. In a court case, it would be near impossible for me to prove that the government gave my private key to someone else and that it wasn't me signing an incriminating document.
I apparently didn't phrase that very well. If what is the case? I was trying to ask which case was the case, not trying to claim that something specific was the case.
I'm familiar with electronic signatures, and I know what documents are, but I have never heard the phrase "electronic signing documents" and don't know what that is supposed to mean. What kind of documents? Documents about signing, documents that were signed, documents in the sense that files containing keys could be considered documents, or what?
In Portugal we were early adopters for digital signatures on citizen cards.
You use the card reader, insert your gov-issued identification and can sign PDF papers which have legal validity since the private key from the citizen card was used.
Now imagine someone signing random legal documents with your ID for things like debts, opening companies or subscritions to whatever.
We might've lucked out here, there is some signature data on ID cards today and official _plans_ to make a government backed signing service, but practically _nobody_ uses them in practice to just revoking all those keys will be a minor issue.
Currently most Swede's use a private bank consortisum controlled ID solution for most logins and signatures.
To the best of my understanding it means that a system made by CGI for digital signing of documents (as in: you get something like a PDF from a government agency and need to digitally sign it and send it back) has had its source code and/or some data belonging to it leaked.
Skatteverket, the Swedish tax authority, has been quoted in media as confirming that they use CGI's system for digital document signing but that none of their data nor that of any citizens has been leaked.
"One of the government agencies that uses CGI’s services is the Swedish Tax Agency, which was notified of the incident by the company. However, according to the Swedish Tax Agency, its users have nothing to worry about.
“Neither our data nor our users’ data has been leaked. It is a service we use for e-signatures that has been affected, but there is no data from us or our users there,” says Peder Sjölander, IT Director at the Swedish Tax Agency."
So if no data was leaked from the tax agency or from the users, then the leaked "digital signing documents" must have belonged to the only remaining party, which is CGI, so perhaps they were just some marketing documents about the benefits of their digital signing service?
The original phrasing from the attacker, from the website that put the data up for download/sale, was ”documents (for electronic signing)” which implies that they’re documents that would be signed in said system. I would take all of this with a large helping of salt though. CGI claims it’s not real production data anyway; maybe it is and maybe it’s not.
The best case scenario is in line with what CGI claims: these are lorem ipsum fake docs from an old git repo for a test instance of the system.
Does anyone know if there is the source code for the Swedish Armed Forces - Team Test [1] in the leak? It was a really fun collaborative flash-style game that got popular in my circle of friends for some reason back then.
Yeah. In these cases it's not like anyone is going to spin up their own instance and start competing with you.
Government / handles society-critical things code should really be public unless there are _really_ good reasons for it not to be, where those reasons are never "we're just not very good at what we're doing and we don't want anyone to find out".
When I started it was a big security theater. Had to develop on thin clients with no external internet access, for instance. Then they got some great people in charge that modernized everything.
Only drawback is when you quit, you have to make sure to unsubscribe from everything, hehe. When quitting a private company I was just removed from the github org. Here I was as well, but I was still subscribed to lots of repos, issues, PRs,heh.
Very cool! Do they accept external contributions, e.g. from Norwegian citizens? Also, was there any thought given to "digital souvereignty" (wondering because the repos are hosted on a US service)?
I'm also surprised that you were able to (or expected to?) use your private GitHub account for your work.
Few years ago a huge NRA database was left public with admin/1234 or similar by the Bulgarian NRA. They government fined itself some non-trivial amount, then in the source/destination IBAN they put the same value and paid the fine. They managed to find someone to blame and it was not the person who left the database but the person who found it. Turns out that if you leave the PII of a whole country open to the public it is not your fault and you get to keep your cozy job. It is already unlawful to access that, so if someone access it - it is his fault - he broke the law.
Edit, i checked the facts: The Bulgarian government said that the it should pay too much to itself, and appealed the fine for few years until it somehow expired. And the guy (20 year at that time) they accused was later acquitted after they tried to ruin his life.
As the attack actor now has the data, they're liable for ongoing GDPR failures, on top of the theft. Then anyone they sell the data to becomes liable (on top of handling stolen goods). Could be a money-earner for the EU if they pursue it properly.
I think what the comment meant was that it's harder for an individual to lose their paper documents compared to losing the electronic ones. It just shifts who's responsible for keeping them safe
"Fireproof file rooms and cabinets in the 1920s were crucial for protecting business and government records during the rapid expansion of the industrial era. The era saw a massive shift from flammable wooden office furniture to robust, steel-based storage designed to resist both fire and water damage."
That's a Google AI summary - but I've been in a fair number of buildings with such rooms. Thick concrete walls, heavy steel fire doors, no other openings, nothing but steel file cabinets in 'em, sealed electric light fixtures that look like they belong in a powder magazine (where one spark could kill everyone) - it's really simple tech.
And "high ground" was a reliable flood protection tech several centuries before that.
Then add “earthquake” to the list, or “domestic terrorists or foreign country bombing the building”. Steelman the argument. The point isn’t “just fire and water specifically”, we’re not playing Pokémon.
We have several historic examples of records being lost in disasters, and way more recent than 100 years ago.
It makes no difference that we could’ve prevented that with better building construction. We didn’t, and hindsight does not bring the records back. We should plan for the world we want but cannot ignore the world we have.
I’m not defending digital as always better or criticising physical. Like I said, different tradeoffs, meaning there are advantages and disadvantages to both, there’s no solution which is better in all situations.
I stuck to the threats you mentioned. Paper in a file room is more slightly more quake-resistant and bomb-resistant than digital. But slower to move to safety if the threat is large volcanic eruptions.
I am not saying that paper is magically perfect. Nor better in every situation. I am saying that paper is far easier (than digital) to do well for use cases like a national records collection. "Correctly" may include off-site backups - whether or not your threat model includes massive earthquakes, volcanoes, bombs, special forces, EMP weapons, biological agents, civil war, radioactive fallout, or enemy occupation. Or "Management wouldn't pay for a done-right facility".
As I noted in another comment, the largest downside to paper (within such use cases), is that it is far more difficult to get political support for old-fashioned stuff that just works, compared to anything that can be sold as cool/new/high-tech. Especially when the taxpayer-funded revenue streams from selling/installing/supporting the tech create incentives clearly contrary to the taxpaper's long-term interests.
I am a Swedish citizen. Lived here for almost 40 years. It is a bit unclear to be what the "the Swedish e-government platform" is. Would have been great if they at least could have published which domain name the service has.
Some other comments mention BankID private keys . That would be the biggest disaster as that’s what everyone uses to identify themselves “securely” on all government services.
Yes, nothing and the facts that these are government services, they use BankID and they updated their websites with "maintenance work" announcements for tomorrow, Saturday. For kronofogden.se there was no maintenance planned just half an hour ago. Knowing swedish tendency to plan things months ahead I would _guess_ that this maintenance work has been rushed due to some circumstances.
It's quite possible that the maintenance is related, but I can nearly 100% assure you this has absolutely nothing to do with BankID. I don't know who suggested that but they are either poorly informed or actively trying to sow FUD.
Nothing in particular, based on my understanding CGI a Swedish IT consultant company was hacked, they have contracts for and are the maintainers and developers of a bunch of various government departments IT services.
It's not going to be a specific service or agency with a domain name, it's going to be services that are either internal and used by employees only, or that are integrated into other systems that you may be interacting with without knowing it.
– Neither our data nor our users' data has been leaked. It is a service we use for e-signatures that has been affected, but there is no data from us or our users there, says
The information that source code was leaked from a joint government e-platform is not true, according to Peder Sjölander.
– There is no such platform. I think the perpetrators in this want people to feel insecure. We feel confident that our data is safe and we have the situation under control before the tax return period opens next week.
This keeps happening in Europe with these mega-IT suppliers repeatedly getting exposed using very bad development practices. Sweden most recently had a major breach back in 2024 when the other large IT services supplier TietoEvry had their data centres breached and claimed "not actually an issue of security".
Several government organisations / regional authorities and companies were down. Last I heard several medical journals for whole municipalities were just destroyed.
Unfortunately, the public tender process encourages awarding contracts to these giants that repeatedly fail to deliver on even basic opsec and still believe in security-by-obscurity, are suspicious of things like zero-trust, follow outdated engineering practices. Sigh.
The tender process is what they are optimised for. They are professional project bidders with a bit of outsourced software development bolted on the back.
> Unfortunately, the public tender process encourages awarding contracts to these giants that repeatedly fail to deliver on even basic opsec and still believe in security-by-obscurity
So what you think would be the solution ? From what I see (both public tender or not), I would claim that "any large IT project/company will suffer from security issues", so not sure what is the added value to single out a process (the tender) or a region (Europe) if there is no obvious alternative.
I have (the start of a) solution, but it's a boring one:
You have to have people who care about this stuff.
If you don't care, the rest does not matter. It does not matter if, when and how you outsource if you don't care about the outcome. You can't just pay someone a salary, nor a consulting bill, check the box and say you've done your part.
And the other way around: These huge consulting conglomerates would get very few jobs if purchasers cared about the details, and not just that all the boxes are checked.
I don't think that's a particularly novel idea, the question is how do you get people who care in an organization that has hundreds of thousands of employees (the public sector)?
You may not like the trivial answer: The same way as we do everything else. How do we get people to show up for work? How do we get people to respect data security boundaries? None of these are questions of technology. The answer is culture. We need to create a strong shared culture of caring, by hiring people that care and putting them in an environment where caring is appreciated.
> You have to have people who care about this stuff.
What?! Preposterous! How could you even make money out of that? No no no, that will not do. You will ask your AI agent some vague question, commit the result without review and push it to the client. And you’ll like it. If there’s any trouble, call Timothy, he’ll be on vacation with his family in Thailand. Some resort, “Lotus” something or other.
Germany has iirc liability for the entire chain (engineers to upper management) in case of data breaches. I remember having to sign for that when I did a project in Germany. Would that help? I would not mind if the CEO/CTO of Odido would spend a couple of years in a federal pound them in the ass prison if it is found out the leak was due to malpractice.
Split giant projects into small ones, award it to better smaller companies, require interoperability via API that is clearly documented and ask for around the clock security monitoring and patching. The last things being the same thing you do at any decent private company.
IBM or Accenture or whoever don't need to be the only ones winning tenders.
The total number of people working on the project might remain similar no matter if it's one company or many smaller companies. Writing clear documentation and API, well thought from the start is harder the larger the project.
Maybe there would be a benefit from having less layers of management, but multiple small companies or one big could have the same structure.
Absolutely. One of the root causes for these terrible tender processes is a fear of in-housing competence and skill for systems.
It's the same reason major govt. IT orgs keep pushing for closed source (recently the Swedish Tax Authority was in the media for _pushing for Office 365_ as necessary for operations), out-sourced designs, big firm purchases over FOSS or real standards.
You need people that care (and they exist, even in the gigantic state orgs.) in positions to make good decisions. Right now, everything is up in the hands of nebulously defined managerial staff with none-to-doubtful technical competence.
Another recent case: the Swedish digital exams platform flopped at a rough cost of a billion SEK. Can't sustain 150K concurrent users, despite paying a "large company". Like, come on.
The probleme here is that what tends to happen is that the security requirements are relatively vague and once the customer has signed the acceptance, good luck.
And signing up with a big company is good way to cover your behind, because "if they with all their people and knowledge could not do it...". Basically the mantra or "Nobody was ever fired for buying Cisco".
Swedish news has some quotes from authorities that nothing of value has been leaked, and a quote from the service CGI that it only concerns test servers.[1][2]
As a Swede this is giving me shudders, the statements reeks of paper-pushers and certification-chasers that don't seem to understand fundamental risks of how how threat actors can move around once having established footholds, hopefully there's more competent people down in the trenches.
I dont know nothing about this particular leak, but I have worked at Skatteverket.
Let me just say, the likelihood that CGI would have any _actual_ real personal data is close to 0%, at least on servers outside of Skatteverket. I had access to absolutely nothing even working inside. I have never worked in a more closed-down system, maybe excepting the swedish military "complex". No, actually that was less locked down in a way, at least once you were "inside" the system.
Knowing swedish people's mindset I'm not surprised at all by the breach. What can be mildly surprising is that no major e-gov service has expressed concerns on their websites. Only on skatteverket.se, which is Swedish Tax Service website, there is a vague note on "maintenance work" planned for coming Saturday. Maybe totally unrelated though.
Similarly taxpayer funded contracts for any type of infrastructure (obviously I have digital infrastructure powered by proprietary solutions in mind) should only be awarded if interoperability is guaranteed to prevent lock-in and abuse.
Ok, some important context for non-Swedes.
Anyone can get access to all Swedish (non-protected but those are a very VERY small subset) personal identification numbers by simply signing an agreement with SPAR[1] (the Swedish national people database). Identification numbers per se are not particularly useful or hard to get, they are effectively public information. Using SPAR you can also get the home (and any additional) addresses of individuals
A Swedish citizen database is... you know. fun. But not exactly hard to get hold of.
No, public information for anyone. You realize that if it's public information, then it's public, and anyone can re-publish it online? There are websites for that. I can get the complete identification number, home address, phone number, etc for any Swedish citizen (that does not have a protected identity) in less than a minute.
I cannot trivially get the whole database, no. But I kind of fail to see what a malicious actor would do with a large database of public information that they couldn’t otherwise do. The system is designed such that you can’t really do a lot of malicious stuff with just public data, and the stuff you can do (scam calls, etc) is probably not meaningfully more effective if you have the whole database than if you do manual lookups or web scraping. I’m open to being proved wrong about that however.
Basically: obviously it's not desirable to have that full database in the hands of a malicious actor but I'm not sure it's such a big deal either. Again, it's public data by design.
In the US, property tax records are public by design. However, historically the records were physical and hard to search through. Now that these records are digitized and published online, it is trivial to find out where someone resides by searching through these records. So while public by design, at scale data aggregation changes the threat model.
I think this is good to highlight for non-Scandinavians.
Scandinavian countries are extremely open and transparent in a way that might be shocking for Americans. For example, in Norway, I can check nearly anyone's brokerage account holdings, addresses, phone numbers, etc. on public websites. I can in theory look up anyone's tax filings.
Personal identification numbers do not tend to be considered private in the same way that social security numbers in the US are.
I heard a rumor that some people use this to check their neighbour's revenue and sometimes make snark comments if one of them has a high revenue but lives in a "average revenue" part of town.
They'd say that if you earn a lot, you shouldn't take a cheap housing.
Making snark comments about that sounds very unlikely. More likely they'd have respect for someone living frugally and not showing off. See https://en.wikipedia.org/wiki/Law_of_Jante
Is this not trivial to get a random person to check stuff for you in exchange for making requests for them (on people they are interested in)? Or is that illegal?
There used to be a lot more of that, but a system was put in place where you have to identify yourself with electronic ID to access the information, and the information is logged so the other party can see it.
Nowadays I think mostly journalists use it to pull up information about politicians and other people that are in the public spotlight. There are of course the yearly "richest people in Norway" lists in various categories.
> There used to be a lot more of that, but a system was put in place where you have to identify yourself with electronic ID to access the information, and the information is logged so the other party can see it.
Yeah, kind of a fake solution, request it via Ratsit or whatever and all they get to see is that someone used Ratsit, but not who actually requested it.
Same goes for criminal cases, using Krimfup or whatever just leads to the service's name "leaking", while you can use fake details to sign up for both Ratsit and Krimfup.
I think it was covered during a discussion about immigrants that are easily rejected - because they're immigrants.
The points was that it added another layer of issues for immigrants because they didn't understand the neighbourhood they "should be living in" with their revenue.
Why is this not the “shit people do shit things” category? This happens even without being immigrants. Large part of my family lives in a way poorer neighborhood than what we can afford, because we don’t care to move. People who have problem with this had other problems even before we got richer. There is exactly zero difference. The exact same people are snark as before, just for something else now. They were and would be snark even without this.
This seems to me a very bad attempt to hide xenophobia.
> They'd say that if you earn a lot, you shouldn't take a cheap housing.
I think a lot of "humbleness" is also enforced this way, in the US seems normal (or even some European countries) to flaunt your wealth, and others seem more or less OK with it, while in Sweden it's much more socially unacceptable to in any sort of way brag about being rich, or showing that off. Humble-richness is OK and tolerated, but flagrantly displaying your wealth among the public is generally frowned upon.
So together with that, living in a average neighborhood but have a house that sticks out as clearly "rich person's house" will gain you evil looks from your neighbors, as you're "supposed to" live in a different neighborhood where neighbors look more equal, otherwise you again stick out, which is cause for friction culturally.
Lots of culture in Sweden is less about "lets correctly solve the problem" and more "lets ensure the gaping holes aren't so visible for everyone, so we can ignore it properly".
And then there are widespread amounts of identity theft and mapping out of minorities, but you may sleep well as everyone knowing where you do so is an important step in making sure corruption is no more, don't think too much about it.
Oh yes. I'm Swedish and I do have to admit I have looked up quite a lot of people on these kinds of sites. It's become so normalised to do this even though I also feel like it would be better as a whole if they just did not exist in the first place.
Last update I heard about something being done about it was this:
And I disagree with your entire posts, and probably how you vote.
You criticize these websites when they affect minorities, but you use them yourself to look up men. That seems inconsistent. Why is it okay for your own use but not for others?
> You criticize these websites when they affect minorities, but you use them yourself to look up men. That seems inconsistent.
This is very close to the "Yet you participate in society, how curious" mean, especially since they're implying they would vote in favor of a law that changes it so that the data is no longer public in the same manner.
But then your comment history reveals enough about your intent.
Because it's the law, and it's a good thing as governments and people tend to use violence against minorities. Don't like it? Move to a more racist country like Israel.
Tidö have been going strong and are just starting to clean up our country. I hope they win again but I fear we have another disaster government next election.
I have a job and money so I will not be personally affected but if the left wins MP and V will dictate and it will be 2015 all over again. I do hope their voters take the brunt of the damage up close and personal that is to come from their own votes to this country.
Yes, sadly, and a lot of it is MENA migrants. But that should be no surprise if you have any experience of the world and Sweden.
I think you are trying to be funny, but I am serious.
>“First, before 2015 it was not acceptable to talk about antisemitism which came from immigrant groups from the Middle-East. This made members of the Jewish community feel abandoned. Sweden has now changed and it’s now possible to talk about it and deal with the problem”, Kahn Nord says
> “antisemitism has long been a weapon of regimes in the Middle East, where it is deeply rooted, openly expressed, and legitimized. The spread of this type of propaganda via the internet by regimes such as Iran has contributed to the globalization of this hatred. Recently, it was revealed that the Iranian regime is suspected of having planned to murder Swedish Jews, among them Aron Verständig, the chair of the Official Council of Swedish Jewish Communities (Judiska Centralrådet). According to the Swedish Security Services (Säpo), Iran has also recruited Swedish criminal networks to carry out attacks against Israeli and Jewish targets. The Swedish National Centre for Terrorist Threat Assessment (NCT) has reported that the biggest terror threats in Sweden come from violent Islamists and right-wing extremists, which both have Jews and Jewish institutions as some of their primary targets”.
Official Swedish statistics from the National Council for Crime Prevention (Brå) show a clear rise in antisemitic hate crimes, increasing from 111 cases in 2022 to 217 in 2024 (doubling their share of all hate crimes to 8%), with a sharp surge (>450%) to 110 reports in late 2023 following the October 7 Hamas attack. This increase correlates with large-scale immigration from Arab and Middle Eastern countries, where antisemitic attitudes are significantly higher (e.g., ADL surveys show ~74% prevalence in MENA vs. low native Swedish levels). Multiple studies and reports, including Brå analyses and victim perceptions, indicate that perpetrators are often from Middle Eastern immigrant backgrounds, with spikes tied to Israel-related conflicts and imported attitudes, though not all immigrants are involved.
> This system was one of the oldest IT systems in NAV, and ran in production for 51 years, from when the National Insurance Scheme was introduced in 1967. In January 2018, Presys was put into production, which together with Pesys became the successor to DSF. At that point, DSF was also shut down.
The system is written in PL/I.
It's like the Apollo 11 code, but for social services.
By just accepting it as a normal fact of life that you will have some random stuff ordered in your name sooner or later with an invoice you'll have to dispute. Happened to a relative of mine, police do not care unless they order things above a certain value, without a police report you cannot get free ID protection, and then you'll have to sit for a long time in phone queues trying to cancel a subscription for a streaming service or whatever they ordered while get thrown around by support reps who go "you SURE you or someone in your family didn't order this?"
Yes, I don't think anyone truly wants it to be like this. But it's just what happens.
You of course cannot access and empty out someone's bank account this way, you're safe in that regard. But you need to dispute the invoices as soon as possible to show that it is fradulent, so you don't end up needing to actually pay for it. Or get debt collectors after you.
I am Swedish and never had this happen to me. Never had random things show up or ordered for me at all. What would the point be, you have to pay or get an invoice? For Klarna they use BankID so only I can order an invoice for myself in reputable shops.
I am in my 30s btw so I was alive before BankID and it was a worse time. Remember my parents paid bills with paper.
The root cause of identity theft in USA and some other places is the lack of "proper" national identity and the associated use of various personal "secrets" (not that secret) for identity verification because there are no good easy other ways.
Businesses in Scandinavia and many other countries would not treat someone knowing your personal information as any evidence of identity (because it's not); having all that information is not sufficient to impersonate you there - identity theft does happen but it would require stealing or forging physical documents or actual credentials to things like bank accounts; knowing all of what your mother or spouse would know is not enough to e.g. get credit or get valuable goods in your name.
The US has no single national photo + chip ID card that is available to everybody, for free, including illegal and semi-illegal immigrants and homeless people with no access to their birth certificate and such.
It's completely crazy to me that you can be "out of status" with the USCIS and still get a social security card and a bank account, for example.
Just knowing someone's name, address, and ID number isn't enough to like, open a bank account in their name or such. You'd need a proper ID card or passport for that. Similar thing with most businesses if you try to pay for some product with credit, they won't accept just a few digits and a pinky promise, you'll need to identify yourself properly (the BankID app for instance).
"Identity theft" is newspeak right up there with "intellectual property". It serves the sole purpose of diminishing real theft. If someone says "we gave all your money to this other guy, but it's not our fault because he had stolen your identity" doesn't make it so. There are cases of mistaken identity, and with criminal intentions, but there is also an enormous majority of not checking identity because someone was lazy.
I see comments about Swedish personal identification numbers. But the article is about source code that's leaked, not a database of numbers, right? I was thinking: should government source code not be open source anyway?
The same attackers are releasing the database of personal information separately (for a fee).
That said, Sweden takes a different approach to PII, so most of that information would have already been public. You can generally just look up any resident and their ID number and other biographical details in a public directory (among other things… their tax returns are also public records).
Worked on a similar platform. The real risk isn't the code - it's the config files. Government deployments have hardcoded staging credentials, VPN endpoints, and encryption keys that don't get rotated when code leaks. Source is whatever. Those env files are the skeleton key.
CGI has a lot of consultants in both government and municipal places (i've worked at both), and some of our main tools like time reporting was built as a addon to our personnel system by consultants at CGI. half my team are consultants from CGI, 4 out of 7 people.
also: hi tavro! it's been a few years, how have you been :D
robertlagrant | 9 hours ago
> citizen PII databases and electronic signing documents were also collected but are being sold separately
simonklitj | 9 hours ago
blell | 9 hours ago
xorcist | 9 hours ago
And if we are to believe the hacked company, it is a development environment with test data in it. That remains to be seen, but is a risky thing to lie about. If there is production data in the leak, we will surely know about it.
UltraSane | 8 hours ago
lukan | 9 hours ago
dns_snek | 8 hours ago
That's not an excuse though, any system handling data like that should be continuously reviewed and pentested by professionals. Hopefully they can show that this has been done otherwise it's just negligence.
lukan | 8 hours ago
dns_snek | 7 hours ago
> Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize
fc417fc802 | 8 hours ago
jjgreen | 7 hours ago
dijit | 9 hours ago
Being able to validate that a citizen is a citizen and their ID is valid inherently requires the system be accessible
fc417fc802 | 8 hours ago
dijit | 8 hours ago
AdamN | 9 hours ago
embedding-shape | 3 hours ago
worldsayshi | 9 hours ago
ACS_Solver | 9 hours ago
worldsayshi | 9 hours ago
https://www.aftonbladet.se/nyheter/a/ArvG0E/cgi-sverige-uppg...
yaris | 8 hours ago
zyberzero | 8 hours ago
einr | 7 hours ago
No. CGI has nothing to do with BankID.
IMO the most credible reports suggest that the source code and data involved are related to these four services:
https://www.cgi.com/se/sv/business-process-services/e-tjanst... "Mina engagemang offers a user-friendly and flexible solution that allows your customers to manage their cases directly through a personal portal. Here, users can view, track, and interact with their ongoing cases, which enhances both transparency and efficiency in the communication process." -- some kind of ticket/case management system for gov't agencies
https://www.cgi.com/se/sv/business-process-services/elektron... "With our secure end-to-end e-ID and eSign services, we can help you streamline document and contract management, gain access to all desired e-ID issuers, and improve cost efficiency." -- this sounds like a bad thing to compromise, but is to the best of my understanding a system for digital signatures on documents, and has no relation to BankID
https://www.cgi.com/se/sv/business-process-services/e-tjanst... "Gain better control over your organization’s representatives with our easy-to-use representative registry. By automating the identification and verification of representatives, you’ll gain a clear overview and enhance the security of your processes." -- sounds like some bullshit CRUD app for managing who can "represent" a gov't agency
https://www.cgi.com/se/sv/business-process-services/e-tjanst... "SHS is Sweden’s common standard for information exchange, enabling secure and efficient communication between government agencies, businesses, and organizations." -- this might be bad if real data was leaked
These are services used by various Swedish government agencies and it's pretty bad to have even a test instance of them hacked, but let's calm down. The entire Swedish state has not been compromised here.
jonashus | 7 hours ago
That's incorrect. Skatteverket used CGI for BankID-login, I don't know if they still do. I have personal experience working on a BankID-login using CGI for another company and it is still active.
Edit: I just confirmed Skatteverket still uses CGI for BankID-auth. "funktionstjanster" is CGI.
einr | 7 hours ago
jetsetman192 | 9 hours ago
ptx | 8 hours ago
nunobrito | 8 hours ago
Because in that case they can sign documents on my behalf without my permission. In a court case, it would be near impossible for me to prove that the government gave my private key to someone else and that it wasn't me signing an incriminating document.
ptx | 7 hours ago
I'm familiar with electronic signatures, and I know what documents are, but I have never heard the phrase "electronic signing documents" and don't know what that is supposed to mean. What kind of documents? Documents about signing, documents that were signed, documents in the sense that files containing keys could be considered documents, or what?
nunobrito | 7 hours ago
You use the card reader, insert your gov-issued identification and can sign PDF papers which have legal validity since the private key from the citizen card was used.
Now imagine someone signing random legal documents with your ID for things like debts, opening companies or subscritions to whatever.
whizzter | 7 hours ago
Currently most Swede's use a private bank consortisum controlled ID solution for most logins and signatures.
einr | 7 hours ago
Skatteverket, the Swedish tax authority, has been quoted in media as confirming that they use CGI's system for digital document signing but that none of their data nor that of any citizens has been leaked.
https://www.svt.se/nyheter/inrikes/uppgift-statlig-it-inform...
"One of the government agencies that uses CGI’s services is the Swedish Tax Agency, which was notified of the incident by the company. However, according to the Swedish Tax Agency, its users have nothing to worry about.
“Neither our data nor our users’ data has been leaked. It is a service we use for e-signatures that has been affected, but there is no data from us or our users there,” says Peder Sjölander, IT Director at the Swedish Tax Agency."
ptx | 6 hours ago
einr | 6 hours ago
The best case scenario is in line with what CGI claims: these are lorem ipsum fake docs from an old git repo for a test instance of the system.
teroshan | 9 hours ago
[1] https://flashism.wordpress.com/2010/03/09/swedish-armed-forc...
steve1977 | 9 hours ago
rebolek | 9 hours ago
P.S.: And strangers will sometimes help you find vulnerabilities (and sometimes be very obnoxious but that's not open source's fault).
ZaoLahma | 8 hours ago
Government / handles society-critical things code should really be public unless there are _really_ good reasons for it not to be, where those reasons are never "we're just not very good at what we're doing and we don't want anyone to find out".
matsemann | 5 hours ago
When I started it was a big security theater. Had to develop on thin clients with no external internet access, for instance. Then they got some great people in charge that modernized everything.
Only drawback is when you quit, you have to make sure to unsubscribe from everything, hehe. When quitting a private company I was just removed from the github org. Here I was as well, but I was still subscribed to lots of repos, issues, PRs,heh.
jmusall | 2 hours ago
I'm also surprised that you were able to (or expected to?) use your private GitHub account for your work.
Lionga | 9 hours ago
Who will take responsibility and get fired and lose all pension etc.? Oh wait no one.
Well the citizens need to suck it up.
Habgdnv | 9 hours ago
Edit, i checked the facts: The Bulgarian government said that the it should pay too much to itself, and appealed the fine for few years until it somehow expired. And the guy (20 year at that time) they accused was later acquitted after they tried to ruin his life.
the_other | 8 hours ago
noosphr | 9 hours ago
It's very hard to steal everyone's documents when they weight about the same as a train.
latexr | 9 hours ago
HelloUsername | 8 hours ago
Wouldn't a fire or flood affect everything? Both data stored on paper and hard disks?
jagged-chisel | 8 hours ago
Gabrys1 | 8 hours ago
bell-cot | 7 hours ago
"Fireproof file rooms and cabinets in the 1920s were crucial for protecting business and government records during the rapid expansion of the industrial era. The era saw a massive shift from flammable wooden office furniture to robust, steel-based storage designed to resist both fire and water damage."
That's a Google AI summary - but I've been in a fair number of buildings with such rooms. Thick concrete walls, heavy steel fire doors, no other openings, nothing but steel file cabinets in 'em, sealed electric light fixtures that look like they belong in a powder magazine (where one spark could kill everyone) - it's really simple tech.
And "high ground" was a reliable flood protection tech several centuries before that.
latexr | 7 hours ago
We have several historic examples of records being lost in disasters, and way more recent than 100 years ago.
https://en.wikipedia.org/wiki/National_Personnel_Records_Cen...
It makes no difference that we could’ve prevented that with better building construction. We didn’t, and hindsight does not bring the records back. We should plan for the world we want but cannot ignore the world we have.
I’m not defending digital as always better or criticising physical. Like I said, different tradeoffs, meaning there are advantages and disadvantages to both, there’s no solution which is better in all situations.
bell-cot | 6 hours ago
I am not saying that paper is magically perfect. Nor better in every situation. I am saying that paper is far easier (than digital) to do well for use cases like a national records collection. "Correctly" may include off-site backups - whether or not your threat model includes massive earthquakes, volcanoes, bombs, special forces, EMP weapons, biological agents, civil war, radioactive fallout, or enemy occupation. Or "Management wouldn't pay for a done-right facility".
As I noted in another comment, the largest downside to paper (within such use cases), is that it is far more difficult to get political support for old-fashioned stuff that just works, compared to anything that can be sold as cool/new/high-tech. Especially when the taxpayer-funded revenue streams from selling/installing/supporting the tech create incentives clearly contrary to the taxpaper's long-term interests.
noosphr | 7 hours ago
latexr | 6 hours ago
noosphr | 21 minutes ago
bell-cot | 8 hours ago
JensRantil | 9 hours ago
yaris | 8 hours ago
brabel | 8 hours ago
mrkickling | 6 hours ago
einr | 8 hours ago
yaris | 7 hours ago
einr | 7 hours ago
reliablereason | 8 hours ago
einr | 7 hours ago
lysace | 7 hours ago
https://www.svt.se/nyheter/inrikes/uppgift-statlig-it-inform...
– Neither our data nor our users' data has been leaked. It is a service we use for e-signatures that has been affected, but there is no data from us or our users there, says
The information that source code was leaked from a joint government e-platform is not true, according to Peder Sjölander.
– There is no such platform. I think the perpetrators in this want people to feel insecure. We feel confident that our data is safe and we have the situation under control before the tax return period opens next week.
corroclaro | 9 hours ago
Several government organisations / regional authorities and companies were down. Last I heard several medical journals for whole municipalities were just destroyed.
Unfortunately, the public tender process encourages awarding contracts to these giants that repeatedly fail to deliver on even basic opsec and still believe in security-by-obscurity, are suspicious of things like zero-trust, follow outdated engineering practices. Sigh.
bengale | 9 hours ago
Maxion | 8 hours ago
The tender process + clueless buyers + tender process law(s) cause this. Whole process needs a revamp for this to not be a problem.
vladms | 8 hours ago
So what you think would be the solution ? From what I see (both public tender or not), I would claim that "any large IT project/company will suffer from security issues", so not sure what is the added value to single out a process (the tender) or a region (Europe) if there is no obvious alternative.
xorcist | 8 hours ago
You have to have people who care about this stuff.
If you don't care, the rest does not matter. It does not matter if, when and how you outsource if you don't care about the outcome. You can't just pay someone a salary, nor a consulting bill, check the box and say you've done your part.
And the other way around: These huge consulting conglomerates would get very few jobs if purchasers cared about the details, and not just that all the boxes are checked.
dns_snek | 7 hours ago
xorcist | 6 hours ago
latexr | 7 hours ago
What?! Preposterous! How could you even make money out of that? No no no, that will not do. You will ask your AI agent some vague question, commit the result without review and push it to the client. And you’ll like it. If there’s any trouble, call Timothy, he’ll be on vacation with his family in Thailand. Some resort, “Lotus” something or other.
mvdwoord | 7 hours ago
ExoticPearTree | 5 hours ago
IBM or Accenture or whoever don't need to be the only ones winning tenders.
vladms | 4 hours ago
Maybe there would be a benefit from having less layers of management, but multiple small companies or one big could have the same structure.
corroclaro | 4 hours ago
It's the same reason major govt. IT orgs keep pushing for closed source (recently the Swedish Tax Authority was in the media for _pushing for Office 365_ as necessary for operations), out-sourced designs, big firm purchases over FOSS or real standards.
You need people that care (and they exist, even in the gigantic state orgs.) in positions to make good decisions. Right now, everything is up in the hands of nebulously defined managerial staff with none-to-doubtful technical competence.
Another recent case: the Swedish digital exams platform flopped at a rough cost of a billion SEK. Can't sustain 150K concurrent users, despite paying a "large company". Like, come on.
ExoticPearTree | 5 hours ago
And signing up with a big company is good way to cover your behind, because "if they with all their people and knowledge could not do it...". Basically the mantra or "Nobody was ever fired for buying Cisco".
blin2h | 9 hours ago
agluszak | 8 hours ago
nunobrito | 8 hours ago
Public money, public code.
wasmitnetzen | 8 hours ago
[1]: https://www.svt.se/nyheter/inrikes/uppgift-statlig-it-inform...
[2]: https://www.cgi.com/se/sv/news/cybersakerhet/cgi-informerar-...
whizzter | 7 hours ago
cactusplant7374 | 7 hours ago
sandos | 3 hours ago
Let me just say, the likelihood that CGI would have any _actual_ real personal data is close to 0%, at least on servers outside of Skatteverket. I had access to absolutely nothing even working inside. I have never worked in a more closed-down system, maybe excepting the swedish military "complex". No, actually that was less locked down in a way, at least once you were "inside" the system.
yaris | 8 hours ago
queuep | 8 hours ago
corroclaro | 4 hours ago
Of course, they might be wrong!
WhereIsTheTruth | 8 hours ago
Accountability now, send these people to prison
elwebmaster | 7 hours ago
fsflover | 7 hours ago
teroshan | 6 hours ago
wayfwdmachine | 7 hours ago
A Swedish citizen database is... you know. fun. But not exactly hard to get hold of.
[1] https://www.statenspersonadressregister.se/master/start/engl...
petcat | 7 hours ago
But that seems like a completely different thing than a nefarious and anonymous person or group having access to the entire database.
wayfwdmachine | 7 hours ago
petcat | 7 hours ago
einr | 7 hours ago
petcat | 7 hours ago
einr | 7 hours ago
Basically: obviously it's not desirable to have that full database in the hands of a malicious actor but I'm not sure it's such a big deal either. Again, it's public data by design.
hrimfaxi | 4 hours ago
picafrost | 7 hours ago
Scandinavian countries are extremely open and transparent in a way that might be shocking for Americans. For example, in Norway, I can check nearly anyone's brokerage account holdings, addresses, phone numbers, etc. on public websites. I can in theory look up anyone's tax filings.
Personal identification numbers do not tend to be considered private in the same way that social security numbers in the US are.
ahoka | 7 hours ago
whynotmaybe | 7 hours ago
They'd say that if you earn a lot, you shouldn't take a cheap housing.
Any truth to that?
sorum | 7 hours ago
There's also the underlying current of Jantelagen (Law of Jante) https://en.wikipedia.org/wiki/Law_of_Jante
internet_points | 7 hours ago
ale | 6 hours ago
arcticfox | 6 hours ago
vodkapump | 6 hours ago
Media is also allowed to pull "top" lists like the 100 people with the most income in a city, 100 people with the most wealth in a city, etc.
[1] https://sjekkskatt.no/
kivle | 6 hours ago
Nowadays I think mostly journalists use it to pull up information about politicians and other people that are in the public spotlight. There are of course the yearly "richest people in Norway" lists in various categories.
embedding-shape | 3 hours ago
Yeah, kind of a fake solution, request it via Ratsit or whatever and all they get to see is that someone used Ratsit, but not who actually requested it.
Same goes for criminal cases, using Krimfup or whatever just leads to the service's name "leaking", while you can use fake details to sign up for both Ratsit and Krimfup.
ruszki | 5 hours ago
whynotmaybe | 5 hours ago
The points was that it added another layer of issues for immigrants because they didn't understand the neighbourhood they "should be living in" with their revenue.
ruszki | 5 hours ago
This seems to me a very bad attempt to hide xenophobia.
heraldgeezer | 5 hours ago
embedding-shape | 3 hours ago
I think a lot of "humbleness" is also enforced this way, in the US seems normal (or even some European countries) to flaunt your wealth, and others seem more or less OK with it, while in Sweden it's much more socially unacceptable to in any sort of way brag about being rich, or showing that off. Humble-richness is OK and tolerated, but flagrantly displaying your wealth among the public is generally frowned upon.
So together with that, living in a average neighborhood but have a house that sticks out as clearly "rich person's house" will gain you evil looks from your neighbors, as you're "supposed to" live in a different neighborhood where neighbors look more equal, otherwise you again stick out, which is cause for friction culturally.
Lots of culture in Sweden is less about "lets correctly solve the problem" and more "lets ensure the gaping holes aren't so visible for everyone, so we can ignore it properly".
ROllerozxa | 7 hours ago
Batman8675309 | 7 hours ago
But they didn't change it, because "women should be able to look up the men that they date".
ROllerozxa | 6 hours ago
Last update I heard about something being done about it was this:
https://www.regeringen.se/pressmeddelanden/2024/11/utredning...
Not sure what the current status is.
heraldgeezer | 5 hours ago
And I disagree with your entire posts, and probably how you vote.
You criticize these websites when they affect minorities, but you use them yourself to look up men. That seems inconsistent. Why is it okay for your own use but not for others?
Why are minorities so protected? :)
deaux | 3 hours ago
This is very close to the "Yet you participate in society, how curious" mean, especially since they're implying they would vote in favor of a law that changes it so that the data is no longer public in the same manner.
But then your comment history reveals enough about your intent.
heraldgeezer | 3 hours ago
Speak clearly, what do you have an issue with exactly in my comment history?
Hikikomori | 2 hours ago
Because it's the law, and it's a good thing as governments and people tend to use violence against minorities. Don't like it? Move to a more racist country like Israel.
heraldgeezer | 46 minutes ago
But of course you are anti-Semitic and anti-west. Please move to the Third World as you clearly want the west to degenerate to their level.
Hikikomori | 43 minutes ago
heraldgeezer | 37 minutes ago
I have a job and money so I will not be personally affected but if the left wins MP and V will dictate and it will be 2015 all over again. I do hope their voters take the brunt of the damage up close and personal that is to come from their own votes to this country.
weirdmantis69 | 36 minutes ago
heraldgeezer | 22 minutes ago
I think you are trying to be funny, but I am serious.
>“First, before 2015 it was not acceptable to talk about antisemitism which came from immigrant groups from the Middle-East. This made members of the Jewish community feel abandoned. Sweden has now changed and it’s now possible to talk about it and deal with the problem”, Kahn Nord says
> “antisemitism has long been a weapon of regimes in the Middle East, where it is deeply rooted, openly expressed, and legitimized. The spread of this type of propaganda via the internet by regimes such as Iran has contributed to the globalization of this hatred. Recently, it was revealed that the Iranian regime is suspected of having planned to murder Swedish Jews, among them Aron Verständig, the chair of the Official Council of Swedish Jewish Communities (Judiska Centralrådet). According to the Swedish Security Services (Säpo), Iran has also recruited Swedish criminal networks to carry out attacks against Israeli and Jewish targets. The Swedish National Centre for Terrorist Threat Assessment (NCT) has reported that the biggest terror threats in Sweden come from violent Islamists and right-wing extremists, which both have Jews and Jewish institutions as some of their primary targets”.
https://k-larevue.com/en/2025/05/22/sweden/
You like this I bet.
https://jcfa.org/the-uncomfortable-truth-about-malmo-sweden-...
https://www.timesofisrael.com/sweden-reports-sharp-rise-in-a...
Official Swedish statistics from the National Council for Crime Prevention (Brå) show a clear rise in antisemitic hate crimes, increasing from 111 cases in 2022 to 217 in 2024 (doubling their share of all hate crimes to 8%), with a sharp surge (>450%) to 110 reports in late 2023 following the October 7 Hamas attack. This increase correlates with large-scale immigration from Arab and Middle Eastern countries, where antisemitic attitudes are significantly higher (e.g., ADL surveys show ~74% prevalence in MENA vs. low native Swedish levels). Multiple studies and reports, including Brå analyses and victim perceptions, indicate that perpetrators are often from Middle Eastern immigrant backgrounds, with spikes tied to Israel-related conflicts and imported attitudes, though not all immigrants are involved.
Key sources:
Brå report on antisemitic hate crime (2025): https://bra.se/english/publications/archive/2025-08-29-antis...
Brå hate crimes 2024 statistics: https://bra.se/english/publications/archive/2026-01-26-hate-...
European Jewish Congress on 2024 increase: https://eurojewcong.org/news/communities-news/sweden/accordi...
FRA EU survey on Jewish experiences in Sweden (2024, pre-Oct 2023 data showing high perceptions): https://fra.europa.eu/sites/default/files/fra_uploads/fra-20...
(Sweden country sheet: https://fra.europa.eu/sites/default/files/fra_uploads/antise...)
Older Brå report noting Middle Eastern perpetrator backgrounds: https://bra.se/download/18.3808406a192bd2f0b724059/173028344...
Various analyses linking to immigration (e.g., Wikipedia summary, JCPA articles, US State Dept reports citing surveys).
kivle | 6 hours ago
valzam | 4 hours ago
scottyah | 4 hours ago
deepsun | 3 hours ago
Pretty modern stack. I would start a government service using those today.
kivle | 59 minutes ago
Description translated:
> This system was one of the oldest IT systems in NAV, and ran in production for 51 years, from when the National Insurance Scheme was introduced in 1967. In January 2018, Presys was put into production, which together with Pesys became the successor to DSF. At that point, DSF was also shut down. The system is written in PL/I.
It's like the Apollo 11 code, but for social services.
ivell | 6 hours ago
There are so many ways to misuse these data. Are the residents not concerned about this?
boxed | 6 hours ago
bondarchuk | 6 hours ago
SiempreViernes | 5 hours ago
ROllerozxa | 6 hours ago
By just accepting it as a normal fact of life that you will have some random stuff ordered in your name sooner or later with an invoice you'll have to dispute. Happened to a relative of mine, police do not care unless they order things above a certain value, without a police report you cannot get free ID protection, and then you'll have to sit for a long time in phone queues trying to cancel a subscription for a streaming service or whatever they ordered while get thrown around by support reps who go "you SURE you or someone in your family didn't order this?"
PowerElectronix | 5 hours ago
ROllerozxa | 5 hours ago
You of course cannot access and empty out someone's bank account this way, you're safe in that regard. But you need to dispute the invoices as soon as possible to show that it is fradulent, so you don't end up needing to actually pay for it. Or get debt collectors after you.
heraldgeezer | 3 hours ago
So don't take this poster by their word.
Not saying it DOES NOT happen as it is a system not made for the internet. But widespread? It is not.
Hikikomori | 2 hours ago
maest | 4 hours ago
heraldgeezer | 5 hours ago
I am in my 30s btw so I was alive before BankID and it was a worse time. Remember my parents paid bills with paper.
PeterisP | 6 hours ago
Businesses in Scandinavia and many other countries would not treat someone knowing your personal information as any evidence of identity (because it's not); having all that information is not sufficient to impersonate you there - identity theft does happen but it would require stealing or forging physical documents or actual credentials to things like bank accounts; knowing all of what your mother or spouse would know is not enough to e.g. get credit or get valuable goods in your name.
miki123211 | 4 hours ago
It's completely crazy to me that you can be "out of status" with the USCIS and still get a social security card and a bank account, for example.
concats | 5 hours ago
guenthert | 5 hours ago
https://www.youtube.com/watch?v=BK2gKuqbOHo
xorcist | 4 hours ago
stevekemp | 3 hours ago
https://www.youtube.com/watch?v=CS9ptA3Ya9E
einr | 7 hours ago
They are absolutely trivial to get. One click on mrkoll.se.
olalonde | 7 hours ago
bkummel | 6 hours ago
johnisgood | 3 hours ago
FateOfNations | 2 hours ago
That said, Sweden takes a different approach to PII, so most of that information would have already been public. You can generally just look up any resident and their ID number and other biographical details in a public directory (among other things… their tax returns are also public records).
FpUser | 6 hours ago
hollow-moe | 5 hours ago
GuB-42 | 4 hours ago
But it turns out that more than the source code was leaked.
Lliora | 4 hours ago
Schlagbohrer | 4 hours ago
vladde | 4 hours ago
also: hi tavro! it's been a few years, how have you been :D
butz | 3 hours ago
PeterStuer | 2 hours ago
Turns out it's about data.