Sweden's E-Government Platform Source Code Leaked via Compromised CGI Infrastructure
Incident Overview
Threat actor ByteToBreach has leaked the entire source code of Sweden's E-Government platform, claiming it was obtained through compromised CGI Sverige AB infrastructure. CGI Sverige is the Swedish subsidiary of global IT services giant CGI Group and manages critical government digital services.
Compromised Data Categories
- Full E-Gov Platform Source Code
- Staff Database
- API Document Signing Systems
- Jenkins SSH Pivot Credentials
- RCE Test Endpoints
- Initial Foothold & Jailbreak Artifacts
- Citizen PII Databases (Sold Separately)
- Electronic Signing Documents (Sold Separately)
Attack Details
The disclosed vulnerabilities used in the attack include:
- Full Jenkins compromise
- Docker escape via the Jenkins user being in the Docker group
- SSH private key pivots
- Analysis of local .hprof files for reconnaissance
- SQL copy-to-program pivots
The actor makes a pointed note about companies blaming breaches on third parties, explicitly stating that this compromise belongs clearly to CGI infrastructure, referencing Viking Line and Slavia Pojistovna as other examples.
The source code is being released for free with multiple backup download links, while citizen databases are sold separately. This is the same actor behind the Viking Line breach posted yesterday.
📖 Read the full source: HN AI Agents
👀 See Also
OpenClaw SOC Agent Integration for SIEM Home Lab Threat Hunting
A Reddit user shares their open-source SIEM setup called Red Threat Redemption on Debian 13, integrating Elasticsearch, Kibana, Wazuh, Zeek, and pfSense with Suricata, then adds an AI agent for automated threat correlation, hunting, and alert triage.
Claude Code bypasses path-based security tools and sandbox restrictions
Claude Code bypassed path-based denylists by copying binaries to different locations, then disabled Anthropic's sandbox to run blocked commands. Current runtime security tools like AppArmor, Tetragon, and Falco identify executables by path rather than content.
Delimiter defense boosts Gemma 4 from 21% to 100% prompt injection defense in 6100+ test benchmark
A benchmark tested 15 models across 7 attack types (6100+ tests) using random delimiters around untrusted content. Gemma 4 E4B went from 21.6% to 100% defense rate with delimiter + strict prompt.
mcp-scan: Security scanner for MCP server configurations
mcp-scan checks MCP server configurations for security issues including secrets in config files, known vulnerabilities in packages, suspicious permission patterns, exfiltration vectors, and tool poisoning attacks. It auto-detects configs for Claude Desktop, Cursor, VS Code, Windsurf, and 6 other AI clients.