Swedish IT supplier Miljödata was hit by a ransomware attack discovered on Saturday, August 23, 2025. The intrusion compromised systems the company operates on behalf of a large share of Sweden's public sector, including its Adato platform for occupational-health and HR workflows. The attackers reportedly demanded 1.5 bitcoin, equivalent to roughly €144,000.\n\nThe blast radius was unusually wide for a single supplier breach. Approximately 164 municipalities, four regions, multiple universities, and a number of private firms were directly affected, totaling around 250 client organizations. In mid-September 2025, attackers published stolen data on the dark web. The dataset covered roughly 870,000 unique email addresses paired with names, phone numbers, physical addresses, dates of birth, gender, and Swedish personal identity numbers, also known as personnummer.\n\nThe exposure carries severe and durable risk for affected Swedes. The personnummer is a stable government identifier used widely for identity verification, banking, healthcare, and tax purposes, and combined with name and date of birth it is a strong base for identity-verification bypass and account takeover. Health-context records including medical certificates, rehabilitation plans, and work-injury documentation may also have been compromised. Anyone notified by their employer or municipality should treat their personnummer as exposed, monitor for unusual financial activity, and exercise heightened caution with unsolicited contact referencing health, payroll, or government-service matters.

Environmental and sustainability data firms collect client, project, compliance, and reporting records tied to environmental analysis, reporting, and data services.

Miljödata is operating in the aftermath of the August 2025 ransomware attack and continuing to support municipal customers as systems are restored and incident analysis continues. The Swedish government, including the Civil Defence minister and national cybersecurity center CERT-SE, has been involved in the response. A wave of follow-on ransomware activity against Swedish municipalities through late 2025 and into 2026 has kept supply-chain risk a live policy issue. No specific ransomware group has publicly claimed responsibility for the Miljödata incident as of early 2026, and the firm has not disclosed whether the ransom was paid.