Sweden leaked confidential data to IBM in outsourcing deal

The historical leak was only made public this week, and involved 'protected identities'

Sweden's government inadvertently leaked details of its citizens, as well as confidential data, in an outsourcing deal with IBM.

The leak occurred when the Swedish Transport Agency outsourced its hardware, networking and applications services to IBM Sweden in 2015, but details of the breach have only now emerged.

IBM, which is not believed to have been at fault, declined to comment.

The agency's then-director general, Maria gren, decided "to deviate" from the Security Act, the Personal Data Act and the Publicity and Privacy Act as well as the authority's own guidelines for information security requirements, the Swedish government said in a Swedish FAQ (the Transport Agency has since issued an English language statement).

Advertisement
Advertisement - Article continues below

That deviation involved choosing not to subject IBM's operations technicians to security background checks, meaning they viewed the data without security clearance.

She left the role in January, and was fined $8,500 for "carelessness with secret information, but without intent".

Her replacement, Jonas Bjelfvenstam, said: "The authority handles crucial information which affects citizens, companies and other authorities, and it is my firm belief that we, in every situation, must comply with the laws and regulations applicable to the authority's work. Nothing else is acceptable. We take the criticism against the Swedish Transport Agency very seriously. And we would also like to make it clear that we have no indications that data was disseminated improperly." 

Swedish prime minister Stefan Lovfen was quoted in the Financial Times as saying: "What happened in the transport agency is a disaster. It is extremely serious. It has exposed both Sweden and Swedish citizens to risk."

Media reports suggested that military vehicle details and information about people in witness protection programmes was among the data. Sweden's government said no military vehicle details were included, though vehicles registered to civilians were. The Transport Agency has also said there is no evidence that the data was leaked beyond IBM's technicians. 

It did admit it included those with protected identities, but added: "We have no indications indicating that data was disseminated improperly, so we do not see any direct cause for concern."

Swedish news website The Local reported that IBM administrators in the Czech Republic had full access to the information while firewalls and communications were maintained by a company in Serbia, but the Transport Agency said that all data has remained in Sweden "all the time".

Other reports in the Swedish press, such as an article from Dagens Nyheter, have claimed that information such as databases containing criminal records were available to the IT workers.

The agency estimates that the issue will not be resolved until autumn, when personnel handling the "administration of application management" will have had background checks.

This article was updated on 27 July 2017 with more information from the Transport Agency.

Advertisement
Advertisement - Article continues below

Image source: Bigstock

Featured Resources

The IT Pro guide to Windows 10 migration

Everything you need to know for a successful transition

Download now

Managing security risk and compliance in a challenging landscape

How key technology partners grow with your organisation

Download now

Software-defined storage for dummies

Control storage costs, eliminate storage bottlenecks and solve storage management challenges

Download now

6 best practices for escaping ransomware

A complete guide to tackling ransomware attacks

Download now
Advertisement

Recommended

Visit/security/ddos/28039/how-to-protect-against-a-ddos-attack
Security

How to protect against a DDoS attack

25 Oct 2019
Visit/data-breaches/29418/equifax-data-breach-cost-14-billion-so-far/page/0/1
data breaches

Ex-Equifax CIO to serve four months for insider trading

2 Jul 2019
Visit/data-breaches/29418/equifax-data-breach-cost-14-billion-so-far
data breaches

Ex-Equifax CIO to serve four months for insider trading

2 Jul 2019
Visit/data-breaches/29418/equifax-data-breach-cost-14-billion-so-far/page/0/2
data breaches

Ex-Equifax CIO to serve four months for insider trading

2 Jul 2019

Most Popular

Visit/cloud/microsoft-azure/354230/microsoft-not-amazon-is-going-to-win-the-cloud-wars
Microsoft Azure

Microsoft, not Amazon, is going to win the cloud wars

30 Nov 2019
Visit/mobile/mobile-phones/354273/pablo-escobars-brother-launches-budget-foldable-phone
Mobile Phones

Pablo Escobar's brother launches budget foldable phone

4 Dec 2019
Visit/network-internet/wifi-hotspots/354283/industrial-wi-fi-6-trial-reveals-blistering-speeds
wifi & hotspots

Industrial Wi-Fi 6 trial reveals blistering speeds

5 Dec 2019
Visit/hardware/354237/five-signs-that-its-time-to-retire-it-kit
Sponsored

Five signs that it’s time to retire IT kit

29 Nov 2019