Unsecured database exposes 100 million records of Swedish citizens
Learn More
An unsecured database exposed on the internet is leaking financial and personal records of Swedish citizens and organizations.
The leak was discovered by Cybernews researchers, who found an unsecured Elasticsearch server accessible to anyone with internet access. The database contained 100 million records spanning five years of personal, financial, and behavioral intelligence.
Exposed data includes:
- Full legal names, including historical name changes
- Swedish personal identity numbers (equivalent to Social Security numbers)
- Dates of birth and gender information
- Complete address histories, both domestic and international
- Civil status information and records of deceased individuals
- Foreign addresses for Swedish emigrants
- Comprehensive debt records and payment histories
- Bankruptcy information and property ownership indicators
- Income tax data spanning multiple years (2019-2023)
- Activity and event logs including income statement submissions
- Migration status updates and address change records
- Detailed financial and behavioral profiles
The exposed database contained over 100 million records affecting Swedish citizens and organizations, with data spanning from 2019 to 2024. The information was organized across 25 separate database indices, with some individual datasets exceeding 200GB in size. Since Sweden's total population is approximately 10.5 million people, the dataset likely contains multiple records per individual. It's not clear how many individuals are exposed, but even if it's just 10% of tje population it's still a million.
Cybernews sent a disclosure notice to Risika, a Nordic business intelligence firm that initial analysis suggested might be the owner of the database - based on database structure and naming conventions. The exposed server was taken offline the following day, May 11, 2025.
Risika issued a statement denying responsibility for the data exposure. The company's spokesperson stated: "Our preliminary investigation indicates that the data referenced in the reported leak contains information that we do not own, store, or have access to through our business operations.
Since the database was closed after a notification to Risika, even if it's not owned by that company it's clear that Risika knows who is the owner of the database and communicated the issue further.
