A devastating ransomware attack targeted the IT service provider Miljödata, paralyzing approximately 200 municipalities and regions across Sweden during the weekend. The cybercriminals gained access to highly sensitive health data and are now demanding a ransom payment in Bitcoin.
Several local authorities including Region Gotland, Region Halland, and municipalities such as Kalmar, Varberg, Umeå, Luleå, Kiruna, Mönsterås, Karlstad, and Skellefteå were affected by the cyberattack. Region Gotland issued a press release confirming the impact and ongoing investigations at Miljödata to understand the attack's full scope.
The incident caused significant system failures as Miljödata isolated the compromised systems to prevent further damage. Consequently, many municipal services became unavailable, severely affecting day-to-day life in the impacted areas.
The attackers reportedly accessed a large volume of personal data, including medical certificates, rehabilitation plans, accident documentation, and other health-related information. The full extent of the data breach remains unclear.
According to Swedish media sources, the attackers are demanding a ransom of 1.5 Bitcoin, equivalent to roughly 144,000 euros. No ransomware group has publicly taken responsibility for the attack as of now.
The Swedish government responded swiftly. Civil Defense Minister Carl-Oskar Bohlin emphasized on X (formerly Twitter) that the government is taking the cyberattack seriously despite the consequences still being evaluated.
Support and advice are being provided through the Computer Emergency Response Team Sweden (CERT-SE), assisting both Miljödata and its clients. The National Cyber Security Center (NCSC) is coordinating efforts across relevant authorities to manage the situation.