Dutch businesses at risk due to popular password manager with Russian ties
Passwork, a Spain-based password manager used by government agencies, universities, and businesses throughout Europe, including the Netherlands, is secretly of Russian origin and has ties to Russian secret services, according to research by the journalistic collective OCCRP, Investico, NU.nl, De Groene Amsterdammer, and others.
Passwork sells a “password vault” in which company employees can store their passwords. On its English-language website, the software company repeatedly stresses its European background. It says it was founded in Finland in 2017 and recently moved its headquarters to Spain. Passwork says it is “made in the EU” and complies with European privacy and cybersecurity laws.
But according to the journalists, Passwork was actually developed in Russia in 2014 and still offers its software in the country. Large state-owned enterprises like Gasprom and Transnet use Passwork, as do EU-sanctioned defense suppliers like missile manufacturer Avangard and aircraft builder United Aircraft Corporation.
Passwork also has licenses with the Russian Ministry of Defense and the security service FSB. According to Investico, the Russian state requires detailed information about the product’s operation before it issues such a license.
According to Bart van den Berg of Clingendael, that could mean that the Russian government has “extensive insight into the software and its vulnerabilities.” The European and Russian versions of Passwork are technically very similar. So Russia could exploit a vulnerability in the software to target European companies, Van den Berg told Investico. “It doesn’t seem wise to me to hand over the digital keys to your house to such a party,” he said. “That is far too dangerous.”
Investico identified several Dutch users of Passwork, including the major Dutch solar park operator Novar, regional broadcaster RTV Noord, and ICT company Lucrasoft, which states on its website that it also installs Passwork for SMEs.
Experts told Investico that companies like Novar are an attractive target to foreign powers like Russia. If they manage to get enough solar panels under their control, they could cause a large-scale power outage. “This is much more effective than a plane or a bomb,” said Chris van ‘t Hof of the Dutch Institute for Vulnerability Disclosure.
When alerted about Passwork’s Russian ties, Novar told Investico that it stopped using the password manager, changed its passwords, and filed a report with the National Cyber Security Center and the trade association Holland Solar.
RTV Noord that it is convinced that Passwork is a company from Spain with its origins in Finland. The broadcaster will continue using its services for the time being. Lucrasoft did not respond.
