by Jesper Kråkhede, Sweden
Posted in Business, Security Architecture on Sep 24th, 2026
This week the Swedish data protection authority fined the system supplier that was hit by ransomware in August last year. The attack affected a large share of the country´s municipalities, and sensitive data about employees was published. The fine was 1.8 million kronor, for not having appropriate technical and organisational security measures under the GDPR. […]
Posted in Security Architecture, Technology on Oct 15th, 2025
A few weeks ago, travellers at several of Europe´s largest airports had their check-in done by hand. The airports hadn´t been attacked directly. The shared system that many airlines use for check-in, boarding and baggage had been hit by ransomware at its supplier. At one airport it took more than two weeks before the central […]
Posted in Business, Security Architecture on Sep 24th, 2025
At the end of August, a Swedish provider of systems for work environment and HR was hit by ransomware. Around two hundred municipalities and several regions use its systems. Services stopped, and this month the stolen data started to be published. It includes sensitive information about employees: sick leave, rehabilitation and work related incidents. I […]
Posted in Security Architecture, Technology on Sep 17th, 2025
This month a self replicating worm spread through the npm ecosystem, the package registry used by most JavaScript developers. It stole credentials from developers´ machines, including tokens for npm and GitHub and keys for cloud services. Then it used the stolen npm tokens to publish infected versions of other packages owned by the same developers. […]
Posted in Computer Forensics, Security Architecture, Technology on Apr 10th, 2024
At the end of March, a developer noticed that his SSH logins took about half a second longer than they should. Most of us would have shrugged. He didn´t. He investigated, and found a backdoor deliberately planted in xz utils, a compression library used in almost every Linux distribution. It had been inserted by a […]
Posted in Business, Security Architecture on Jan 31st, 2024
After the ransomware attack on a large IT provider in Sweden last week, many managers are asking the same question: What should we have demanded from our provider? Here is my list. Separation. Your environment should be separated from other customers, technically and administratively. Ask how many of the provider´s admins can reach your systems, […]
Posted in Security Architecture, Technology on Jan 25th, 2024
Last weekend a large IT service provider was hit by ransomware in one of its Swedish datacenters. The effects were felt all over the country. Municipalities, government agencies, hospitals, retailers and a cinema chain. Shops closed, a payroll and HR system used by many universities and government agencies went down, and people couldn´t report their […]