When the provider is the weak link, again
Sep 24th, 2025 by Jesper Kråkhede
At the end of August, a Swedish provider of systems for work environment and HR was hit by ransomware. Around two hundred municipalities and several regions use its systems. Services stopped, and this month the stolen data started to be published. It includes sensitive information about employees: sick leave, rehabilitation and work related incidents.
I wrote about supply chain risk after the attack on a large IT provider in January last year. Here we go again, and this time the main damage isn´t downtime. It is the data.
For management, especially in the public sector, a few questions. Which suppliers hold your most sensitive personal data? Do you know how they protect it? Have you assessed them as carefully as you would assess your own systems? And what happens to your employees if the data leaks?
When a large share of all municipalities use the same system from the same small supplier, the risk is concentrated in one place. That is efficient. It is also a single point of failure for a whole sector.
So: Map which suppliers handle sensitive data. Set clear security requirements in procurement and follow them up. Ask for evidence, not promises. Make sure you have the right to be informed quickly, and a plan for your own communication when it happens. And think about whether that data really needs to be kept as long as it is.
Your data is only as safe as the weakest supplier that holds a copy.