Sweden's E-Government Platform Source Code Leaked via Compromised CGI Infrastructure
Incident Overview
Threat actor ByteToBreach has leaked the entire source code of Sweden's E-Government platform, claiming it was obtained through compromised CGI Sverige AB infrastructure. CGI Sverige is the Swedish subsidiary of global IT services giant CGI Group and manages critical government digital services.
Compromised Data Categories
- Full E-Gov Platform Source Code
- Staff Database
- API Document Signing Systems
- Jenkins SSH Pivot Credentials
- RCE Test Endpoints
- Initial Foothold & Jailbreak Artifacts
- Citizen PII Databases (Sold Separately)
- Electronic Signing Documents (Sold Separately)
Attack Details
The disclosed vulnerabilities used in the attack include:
- Full Jenkins compromise
- Docker escape via the Jenkins user being in the Docker group
- SSH private key pivots
- Analysis of local .hprof files for reconnaissance
- SQL copy-to-program pivots
The actor makes a pointed note about companies blaming breaches on third parties, explicitly stating that this compromise belongs clearly to CGI infrastructure, referencing Viking Line and Slavia Pojistovna as other examples.
The source code is being released for free with multiple backup download links, while citizen databases are sold separately. This is the same actor behind the Viking Line breach posted yesterday.
📖 Read the full source: HN AI Agents
👀 See Also
AI Security Researchers: Your 0-Day Vulnerabilities May Leak via Data Opt-In Toggle
The 'Improve the model for everyone' toggle in LLM interfaces can automatically harvest deep red-teaming research, sending your vulnerability concepts to vendor safety teams and potentially to academic papers before you publish. Disable data sharing before conducting serious security research.
FastCGI: 30 Years Old and Still the Better Protocol for Reverse Proxies
FastCGI avoids HTTP desync attacks and untrusted header issues by using explicit message framing and separate parameter channels, making it a safer choice for proxy-to-backend communication.
Meta Ads Contained AI-Generated CSAM; Researchers Found 50+ in Ad Library
Researchers found 50+ paid ads with AI-generated CSAM in Meta's ad library, some reaching thousands of accounts. Meta removed them after WIRED inquiry.
Stacked Defense Layers Drop Prompt Injection to 0 in Claude Code
Anthropic's Boris Cherny says layered defenses—training, intent classifiers, and input probes—reduce prompt injection to 0% on unseen attacks. The classifier is now free.