Dustin Group 2026 Data Security Incident

The IT products and services provider, which operates in the Nordics and Benelux, temporarily shut down certain systems and brought in external cybersecurity specialists. The date when the unauthorised access began has not been made public.

FulcrumSec, which claimed responsibility, describes a broader set of material involving the Skyportal customer identity store, Dustin's Entra directory, Jira and Confluence environments, CRM and finance integrations. Reported fields include names, email addresses, usernames, phone numbers, postal addresses, job titles, account creation dates, account status and login activity.

The group also reports Swedish personal identity numbers in support tickets and IBANs, invoices and payment information in correspondence and financial material. Customer support and service records, purchasing data, source code repositories, internal documents and customer security assessments are included in its account of the incident. These categories come from different systems; they do not imply that every person or account has the same information exposed.

FulcrumSec describes its total holdings as 6.2 TB. This is the group's stated volume of material, not the size of the initial published archives or a count of affected people. It also says the complete CRM extract was withheld from the published files. Dustin's forensic investigation remains ongoing, and the company has not confirmed every detail of this broader scope.

Dustin reported that its websites reopened on 9 September and order portals on 10 September, and that it had notified relevant customers and Sweden's data protection authority, IMY. Organisations using its services should assess incident notifications with their security and data protection teams. Verify unexpected messages requesting access credentials through known Dustin contact channels.