Irish agencies bought FSB-linked software

The bill was modest by the standards of State technology spending: three Irish public bodies paid a combined €13,281 for a password manager called Passwork (Irish Times). It was the sort of purchase that can pass through procurement without much noise. But the product was not a routine office tool. It was designed to hold the passwords staff use to enter internal systems, cloud platforms and administrative accounts.

Who's behind the keyring

A cross-border investigation by the OCCRP, Yle, Le Monde and The Irish Times traced Passwork's ownership chain back to Russian founders (Yle). A sister company held licences from Russia's FSB intelligence service and from FSTEC, a body linked to defence and technical export control (Le Monde). Passwork presented itself as European and "Finnish-rooted". Its Finnish entity operated from 2017 to 2024, with later sales handled through a Spanish company. All three Irish agencies said they understood they were buying from an EU supplier (Irish Times).

The investigators found no evidence that the European version contained a backdoor, meaning hidden code that lets someone bypass normal security, or that customer data had been compromised (Yle). That matters. But with a password manager, the risk is not only what has been proven to happen. It is what control over the product could allow.

A password manager is a master keyring. Email accounts, databases, cloud services and admin panels are the doors; the vault stores copies of the keys. CISA describes these tools as a way to support stronger, unique passwords, but the same centralisation concentrates risk (CISA). If a spreadsheet tool is compromised, one workflow may be affected. If a credential vault is compromised, the routes into many systems can be opened at once.

One Irish agency chose Passwork because it could be run on its own server rather than in the cloud. That can reduce some data flows, but it does not remove the trust problem. Software still receives updates through channels controlled by the vendor, and those updates are the route by which new code enters a system after installation. Support channels and configuration settings also remain live relationships long after the initial setup (Le Monde). If those channels are compromised, local hosting will not by itself protect the secrets inside.

Europe has the rules but skipped them

"EU-based" tells you where a company is registered. It does not tell you who controls the code. Europe already has mechanisms for assessing software trustworthiness. ENISA's cybersecurity certification framework provides for independent evaluation of software products (ENISA). The Cyber Resilience Act, adopted in 2024, places password managers among products that require documented security controls before entering the EU market (CRA). France's national cybersecurity agency recommends formally certified products, which Passwork did not have. NIS2 separately requires covered organisations to assess suppliers' security practices, not just process their invoices (NIS2).

From the public responses so far, the Irish agencies appear to have leaned heavily on the supplier's European identity. The more useful procurement questions are sharper: who can push updates, who controls the source code, who staffs support, and what independent security review has been carried out?

Finland's Supo and military intelligence warned in July 2026 that Russian FSB cyber-espionage was actively targeting Finnish companies through poorly protected enterprise network devices (Supo, Kyberturvallisuuskeskus). Those warnings were not about Passwork specifically. They do explain why a product linked through a sister company to FSB licensing should have triggered a serious supplier-risk review.

France's parliament recently estimated that roughly 80% of public software purchases through the country's central procurement agency go to American publishers, worth about €1.5 billion a year in non-European software (Banque des Territoires). Passwork points to a different sovereignty problem: European labels can conceal opaque ownership. Germany's NIS2 guidance has already pushed this into the boardroom, where senior managers can no longer treat supplier access as routine IT housekeeping (ComplyCheck).

When confidence in a credential vault fails, uninstalling the software is only the first step. Every stored password, including administrator credentials and machine-to-machine passwords, has to be treated as potentially exposed and rotated. NIST's zero-trust framework warns against relying on a single trusted layer (NIST SP 800-207).

Thirteen thousand euro bought three Irish agencies a password manager. It also gave Europe a tidy case study in what happens when procurement checks the price and the EU label, but not the supply chain behind the software guarding the keys.