From Crisis to Insight: Building a More Secure Digital Public Sector

On August 23, Sweden was hit by one of the largest data incidents in modern history. The attack on Miljödata directly affected hundreds of municipalities and organizations, and several weeks later they are still dealing with the consequences. According to SVT, hundreds of thousands of employees’ personal data—names, addresses, personal identity numbers, and contact information—were stolen and leaked in what has been described as one of the most serious breaches to date.

Responses have varied. Some municipalities acted quickly and informed their employees, while others waited for central guidance or struggled with uncertainty about the scope. Even though technical systems could be restored relatively quickly, forensic analyses are taking longer. According to Sveriges Radio, many employees remain worried about how their data might be misused, for example for fraud.

Building Security from the Start

The attack highlights a major weakness in public digitalization: cybersecurity is often treated as something that can be added later rather than designed from the beginning. This is where the concept of secure by design becomes essential.

Secure by design means that security is built in from the outset—in system architecture, in the software code, and in the processes that govern its use. It is like building a house where fire alarms, sprinklers, and emergency exits are drawn into the blueprint, not added after the first fire.

In the Miljödata case, several principles could have made a difference:

Multi-factor authentication as default: Attackers would not have gained access with just a stolen password. An extra layer of security would have stopped or delayed the intrusion.
System segmentation: If systems had been divided into separate parts, a single entry point would not have automatically provided access to all data. The breach would have been far less extensive.
Minimal data collection: By only storing the data truly needed, the volume of sensitive information stolen would have been reduced.
Encryption as a baseline: If data had been encrypted both at rest and in transit, it would have been useless to attackers even if files were obtained.
Automated incident reporting: Systems that trigger alerts on unusual activity could have shortened the time between attack and response, limiting the spread.
Exercises to uncover dependencies: Simulating incidents, for example through tabletop exercises, helps organizations discover critical supply chain dependencies and set clearer requirements for security and follow-up.

In short, secure by design is about building in barriers, safeguards, and safety nets so that a breach cannot have devastating consequences.

Expert Knowledge Early in the Process

The Miljödata attack clearly shows why cybersecurity experts must be involved already in the planning phase. According to Sveriges Radio, several basic routines failed, such as multi-factor authentication and incident reporting. If experts had been part of the process from the start, threat modeling, risk analysis, and technical design choices could have prevented the weaknesses that were exploited.

Complex supply chains also mean that a single weak link can jeopardize the entire system. That was exactly what happened here, as one central supplier became a vulnerability for hundreds of municipalities.

From Reactivity to Resilience

The past few weeks have shown that faster information flows and clearer allocation of responsibility are important, but not sufficient. According to Dagens Samhälle, political initiatives are needed to raise IT security standards. At the same time, a culture of security must be fostered, where security considerations permeate the entire lifecycle—from planning and development to operation and maintenance. Regular incident exercises, from simple tabletop scenarios to more comprehensive simulations, are essential. They help identify both technical and organizational weaknesses in advance and train organizations to act quickly and in unison to limit damage when an attack occurs.

Cyberattacks will continue to happen. The question is whether our systems are built to withstand them, and whether organizations can respond with resilience rather than panic.

Conclusion

The Miljödata attack is still highly relevant. It shows what happens when digitalization moves faster than security. The key takeaway is that cybersecurity cannot be treated as a side issue. It must be integrated into system design, organizational culture, and political decision-making. Involving cybersecurity experts early, designing systems according to secure by design, regularly practicing incident response, and strengthening supply chains are not just technical measures—they are crucial steps to protect both employees and citizens in a digital era.

From Crisis to Insight: Building a More Secure Digital Public Sector