Irish agencies bought FSB-linked password tools

Three Irish state agencies recently spent a combined €13,281 on Passwork, a password manager (Irish Times). On paper, the amount was too small to set off procurement alarms. In practice, it bought software designed to hold the passwords staff use to enter internal systems, cloud platforms and administrative accounts.

For Malta, this is not a distant Irish procurement story. Small states rely heavily on vendor assurances because public-sector IT teams are thin, procurement units are stretched, and a product carrying an EU address can look clean enough to pass. That is exactly where the risk sits.

Who's behind the keyring

A cross-border investigation by the OCCRP, Yle, Le Monde and The Irish Times traced Passwork's corporate chain back to Russian founders (Yle). A sister company held licences from Russia's FSB intelligence service and from FSTEC, a body linked to defence and technical export controls (Le Monde). Passwork presented itself as "Finnish-rooted" and European. Its Finnish entity operated from 2017 to 2024, while later sales were channelled through a Spanish company. All three Irish agencies said they believed they were buying from an EU supplier (Irish Times).

Investigators found no proof that the European version contained a backdoor, meaning hidden code that lets someone bypass normal security, or that customer data had been compromised (Yle). That matters. But with a password manager, the question is not limited to what has already happened. It is also about what access the design of the product makes possible.

A password manager is the digital equivalent of a master keyring. Email, databases, cloud services and admin panels are the doors; the vault stores the keys. CISA describes these tools as a way to support stronger, unique passwords, but the same centralisation concentrates the risk (CISA). If a spreadsheet tool is compromised, one workflow may be hit. If a credential vault is compromised, the routes into other systems multiply.

One agency chose Passwork because it could be run on its own server rather than in the cloud. Local hosting can reduce some data flows. It does not remove the relationship of trust. The code is still updated through channels controlled by the vendor, which is how new code enters the system after installation. Support channels and configuration settings also remain live points of dependence (Le Monde). If those channels are compromised, keeping the software on your own server does not by itself protect the secrets inside.

Europe has the rules but skipped them

"EU-based" is a company registration detail, not a security certificate. Europe already has ways to test software trustworthiness. ENISA's cybersecurity certification framework provides for independent evaluation of software products (ENISA). The Cyber Resilience Act, adopted in 2024, places password managers among products that require documented security controls before they reach the EU market (CRA). France's national cybersecurity agency recommends products with formal security certification, which Passwork did not hold. NIS2 separately requires covered organisations to examine suppliers' security practices, not just process their invoices (NIS2).

From the public responses so far, the Irish agencies appear to have placed too much weight on the supplier's European identity. The real procurement questions are sharper: who controls the code, who can push updates, who answers support requests, and what independent security review has been done.

Finland's Supo and military intelligence warned in July 2026 that Russian FSB cyber-espionage is actively targeting Finnish companies through poorly protected enterprise network devices (Supo, Kyberturvallisuuskeskus). Those warnings are not about Passwork specifically. They do show why a product with an FSB-licensed sister company should have triggered a serious supplier-risk review.

France's parliament recently estimated that roughly 80% of public software purchases through the country's central procurement agency go to American publishers, amounting to around €1.5 billion a year spent on non-European software (Banque des Territoires). Passwork exposes a second sovereignty problem: European labels can hide opaque ownership. Germany's NIS2 guidance has already pushed this into the boardroom, where senior managers can no longer treat supplier access as routine IT housekeeping (ComplyCheck).

When trust in a credential vault fails, uninstalling the software is only the first step. Every password it stored, including administrator credentials and passwords used by machines rather than people, has to be treated as potentially exposed and rotated. NIST's zero-trust framework makes the same point in broader terms: no organisation should rely on a single trusted layer (NIST SP 800-207).

Thirteen thousand euros bought three Irish agencies a password manager. It also gave Europe, including Malta's own public sector and regulated industries, a plain lesson: checking the price and the EU label is not enough when the software is guarding the keys.