2015 Swedish data leak
Native name | Transportstyrelsen |
|---|---|
| Company type | Government agency |
| Industry | Transportation regulation |
| Founded | January 1, 2009 |
| Headquarters | Norrköping , Sweden |
Area served | Sweden |
| Parent | Ministry of Infrastructure (Sweden) |
| Website | www |
The Swedish Transport Agency () functions as a government authority in Sweden tasked with overseeing and regulating transportation across rail, air, maritime, and road sectors, as well as ensuring compliance with relevant legislation. This agency was formed on 1 January 2009 through the consolidation of multiple entities, including the former Civil Aviation Administration, operating under the jurisdiction of the Ministry of Infrastructure.
Its main office is situated in Norrköping, Sweden.
2015 data breach
In September 2015, the Swedish Transport Agency transferred responsibility for its database and IT operations to IBM units located in the Czech Republic and Serbia. This transition involved migrating the agency’s entire database to cloud-based servers accessible by certain foreign personnel, following the dismissal of domestic IT employees.
By March 2016, the Swedish Security Service identified unauthorized foreign access to sensitive governmental IT infrastructure. The agency had circumvented critical security protocols to accelerate this outsourcing process.
Consequently, Director General Maria Ågren stepped down and was prosecuted for negligence later in 2016. A Swedish court ruled her guilty but imposed a penalty equivalent to half a month’s salary. Ågren had assumed office in 2015 during the outsourcing contract phase but prior to its execution. Her predecessor, Staffan Widlert, who retired that same year, was not subjected to any sanctions.
Observers highlighted the seriousness of the compromised information, which encompassed:
- Load limits for roads and bridges—vital data for military transportation planning.
- Personal details such as names, photographs, and residential addresses of Air Force fighter pilots.
- Confidential entries from police registries.
- Identities of members within elite military units comparable to SAS or SEAL teams.
- Information about individuals under protective identities due to security risks.
- Technical data and faults relating to government and military vehicles, exposing support frameworks for defense operations.