Sweden probes alleged leak of e-government source code tied to CGI

Sweden is investigating claims by a threat actor calling itself ByteToBreach that it published source code and sensitive files linked to the country’s e‑government platform operated by CGI Sverige. CGI confirmed a security incident affecting two internal test servers that exposed an older application and its source code; the company reported no evidence that production customer data or active services were impacted. Swedish civil defence minister Carl‑Oskar Bohlin said authorities are working with CERT‑SE and the national cybersecurity centre to identify the perpetrators. Threat intelligence firms noted ByteToBreach previously posted data from the Viking Line breach and warned the activity may be part of a campaign targeting Swedish and European public‑facing infrastructure via CGI’s managed services. Reported leaked items include platform source code, configuration files, internal staff and citizen databases, and electronic signature files, though the full dump has not been independently verified. Security researchers caution that exposed code and documentation could enable follow‑on attacks if vulnerabilities are found in public systems. Given that about 95% of Sweden’s 10.7 million residents use e‑government services, the event poses a potential national‑level risk. Crypto traders should monitor for knock‑on effects including increased threat actor interest in national ID databases, possible phishing or identity‑theft campaigns that can be used to target crypto accounts, and heightened regulatory or security responses that could affect regional fintech and blockchain service providers.