Miljödata Data Breach
Swedish software provider Miljödata operates Adato, a system used to support employee rehabilitation processes. According to Umeå University's official notice, Miljödata was attacked on 23 August 2025.
Exposed Data Types
7- Dates of birth
- Email addresses
- Genders
- Government issued IDs
- Names
- Phone numbers
- Physical addresses
About This Breach
The university later reported that some employee data taken from Adato had been published on the dark web and then on the public internet. More than 100 Swedish organizations were affected.
Confirmed scope
The exposed fields varied by institution. Chalmers University of Technology reported names, personal identity numbers, contact details, gender, and the number of sick-leave days. Umeå University reported names, private and work contact details, gender, and the number of sick-leave days over 15 days. Both institutions said the exposed material did not include the contents of medical certificates, trade-union membership, managers' notes, or reasons for rehabilitation plans.
This catalogue record indexes 870,108 unique email identifiers. That figure is not an official Miljödata or institutional total of affected people; one person may use more than one address. The listed classes (dates of birth, email addresses, gender, government-issued identifiers, names, phone numbers, and physical addresses) describe fields observed in the reviewed dataset. A field should not be assumed to apply to every institution or every person.
Main risks
Identity and contact details combined with employer and sick-leave context can make fraudulent human-resources messages, targeted phishing, and impersonation attempts more convincing. A message should not be trusted merely because it contains a real employer name, phone number, or workplace detail. People whose identity number or address appears in the data should also monitor new-account and credit activity for signs of misuse.
Protective steps
Before opening an unexpected link or attachment claiming to come from Miljödata, Adato, an employer, a municipality, or a university, verify the request through a known institutional channel. Do not disclose passwords, one-time codes, card details, or banking information in response to an unsolicited call or message. Enable multi-factor authentication on the associated email account and replace any password reused on another service with a unique one. Suspected identity misuse should be reported to the relevant institution and local law enforcement.
This summary is based on the English-language official notices published by Chalmers University of Technology and Umeå University. Because those notices describe institution-specific effects of the same incident, the scope should be read together with the limits stated by each source.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
