Irish agencies bought password tools with FSB ties

Three Irish state agencies recently spent a combined €13,281 on a password manager called Passwork (Irish Times). The sums were small enough to slip beneath any procurement alarm. What the agencies got for that money was a tool that stores every password their staff use to access internal systems, cloud platforms and administrative accounts.

Who's behind the keyring

A cross-border investigation by the OCCRP, Yle, Le Monde and The Irish Times traced Passwork's corporate chain back to Russian founders (Yle). A sister company held licences from Russia's FSB intelligence service and from FSTEC, a body tied to defence and technical-export control (Le Monde). Passwork marketed itself as "Finnish-rooted" and European. Its Finnish entity operated from 2017 to 2024; later sales ran through a Spanish company. All three Irish agencies said they believed they were buying from an EU supplier (Irish Times).

Investigators found no proof that the European version contained a backdoor (hidden code that lets someone bypass normal security) or that customer data had been compromised (Yle). That distinction matters. But with a password manager, the question goes beyond what happened to what could happen.

A password manager is a master keyring. Email, databases, cloud services and admin panels are the doors; the password manager holds copies of all the keys. CISA describes these tools as enablers of stronger, unique passwords, but that same centralisation puts all risk in one place (CISA). A compromised spreadsheet tool disrupts one workflow. A compromised credential vault offers routes into everything it protects.

One agency chose Passwork because it could run on the agency's own server rather than in the cloud. Running software locally does limit some data flows. But a password manager's code still gets updated through channels the vendor controls, the route by which new code enters a system after installation. Support channels and configuration settings are also trust relationships that outlast the initial setup (Le Monde). If any of those channels are compromised, local hosting alone does not protect the secrets inside.

Europe has the rules but skipped them

"EU-based" is a corporate registration fact, not a security guarantee. Europe already has tools to verify software trustworthiness. ENISA's cybersecurity certification framework provides independent evaluation of software products (ENISA). The Cyber Resilience Act, adopted in 2024, classifies password managers among products requiring documented security controls before they reach the EU market (CRA). France's national cybersecurity agency recommends products with a formal security certification, which Passwork did not hold. NIS2 separately requires covered organisations to vet their suppliers' security practices, not just their invoices (NIS2).

From the public responses so far, the agencies appear to have relied heavily on the supplier's European identity. Procurement teams should be asking who controls the code, who can push updates, who staffs the support channels, and what independent security review exists.

Finland's Supo and military intelligence warned in July 2026 that Russian FSB cyber-espionage is actively targeting Finnish companies through poorly protected enterprise network devices (Supo, Kyberturvallisuuskeskus). Those warnings are not Passwork-specific, but they show why a product with an FSB-licensed sister company belongs in a serious supplier-risk review.

France's parliament recently estimated that roughly 80% of public software purchases through the country's central procurement agency go to American publishers, around €1.5 billion a year on non-European software (Banque des Territoires). The Passwork case reveals a second sovereignty gap: opaque ownership behind European labels. Germany's NIS2 guidance has already made this a boardroom responsibility, where senior managers can no longer treat supplier access as IT housekeeping (ComplyCheck).

When trust in a credential vault collapses, uninstalling the software is the beginning. Every password it stored, including admin credentials and passwords used by machines rather than people, must be treated as potentially exposed and rotated. NIST's zero-trust framework warns against relying on any single trusted layer (NIST SP 800-207).

Thirteen thousand euros bought three Irish agencies a password manager. It also bought Europe a case study in what happens when procurement checks the price and the label but not the supply chain behind the software guarding the keys.