Published: 2025-09-15

Leaked information has been disseminated – please be vigilant

NEWS On 14 September it became known that personal data leaked in connection with the cyberattack on Miljödata has been disseminated. It is now important that everyone affected is particularly cautious about disclosing further information.

Text: Johanna Fredriksson

Miljödata is the supplier of Adato, the system support used by Umeå University in the rehabilitation process for employees. On 23 August, Miljödata was subjected to a cyber attack. It subsequently became clear that certain personal data belonging to all current employees and some former employees at Umeå University had been leaked from Adato to the attacker. Umeå University is one of more than 100 organisations in Sweden that have been affected.

Read previous news item.

After the attack, Miljödata launched a forensic investigation into the incident. On 11 September, the final report was published and Miljödata was able to announce that no further information than previously known had been leaked.

Over the weekend, however, it emerged that the attacker had spread the leaked information via the Darknet, which is an umbrella term for a specific part of the internet (see facts below), and that it had then spread to the public part of the internet.

The information leaked from Adato includes:

Names
personal identification numbers
contact details
Gender
number of sick days (over 15 days)

Be vigilant

The leaked contact details include both private and work contact information. There is now a risk that the attacker will use this contact information to access more information.

You should always be cautious about disclosing information such as passwords, bank/card details and such. However, it is now particularly important that everyone affected is vigilant and suspicious of emails, phone calls, text messages or other contacts requesting this type of information, or if you are asked to click on, for example, a link or attachment.
The Swedish Civil Contingencies Agency's, MSB:s, website has info and tips on how to spot some of the most common ways attackers try to trick people. There are also checklists on what you can do to protect yourself extra or if you happen to click on a suspicious link or attachment.

Contact the police

If one suspect that someone is attempting to or has stolen personal information contact the police.

More information at polisen.se

If those who work at Umeå University receive suspicious emails or spam through contact details linked to the University, should report this to abuse@umu.se.

Those who are an employee or former employee and have any questions regarding the cyber attack or the information that has been leaked, could contact the Human Resources Department at Umeå University by emailing: ah.adm@umu.se.

What is Darknet?

The Darknet is one of the three levels of the web:
1) At the top is the open web. This is the part that appears in search engines and is used daily by most internet users.

2) The next layer is called the deep web. This can include, for example, pages that require a login.

3) At the bottom is the Darknet. These pages cannot be accessed via a normal web browser and are often encrypted or protected in other ways so that the people behind the pages cannot be traced.

The Darknet is notorious for being the part of the web associated with various illegal activities and businesses, such as the distribution of malware and hacking services.

However, the Darknet as a network is not illegal. There are also advantages to anonymity. For example, the darknet has also helped human rights activists, journalists and whistleblowers to communicate when anonymity has been important for their safety.