# Elitdata i Varberg AB — Complete Infrastructure Breach
**Published:** [DATE]
—
Elitdata i Varberg AB (org.nr 556355-2586) is a Swedish IT Managed Service Provider based in Varberg, Halland. Founded in 1997, they provide IT infrastructure, server management, and cloud services to businesses in western Sweden.
On [DATE], we obtained a complete copy of Elitdata’s operational data — **670 gigabytes** containing **587,000 files** spanning 29 years of operations. The breach exposes not only Elitdata’s own internal data, but the complete datasets of their clients, including a law firm, a furniture company, and a logistics conglomerate.
Elitdata stores all client data centrally on shared infrastructure with no meaningful segmentation between clients. A single compromise cascades through their entire client base.
—
## The Scope
| Dataset | Type | Size | Files |
|—|—|—|—|
| Elitdata i Varberg AB | IT Provider internal ops + 198 client folders | 80 GB | 55,000 |
| Advokatfirman Kurt Lundberg HB | Swedish law firm | 122 GB | 204,000 |
| Artwood AB | Furniture & design company | 205 GB | 327,000 |
| Mantum Group | Logistics & construction conglomerate | 263 GB | 129 |
| **Total** | | **670 GB** | **587,000** |
—
## Elitdata — The IT Provider
**Address:** Västra Vallgatan 7, 432 45 Varberg, Sweden
**Website:** elitdata.se | **Phone:** 0340-86860
Elitdata is owned by Mattias Rödlund and Stefan Qvarford. Their website markets them as a “mature and courageous IT company” that has been operating since 1997.
From their infrastructure we obtained:
**198 Client Organizations** — complete IT documentation for each, including:
– VPN access configurations (.tgb) to connect directly to client networks
– Firewall configurations (full rulesets)
– Bitlocker encryption keys
– Server documentation and network diagrams
– Remote Desktop (RDP) connection files for 50+ client sites
**Wildcard SSL Private Keys:**
– `*.elitdata.se` — certificate with private key (.pem, .pfx), valid 2025-2026
– `*.mantum.se` — certificate with private key (.key, .pem, .pfx), valid 2026
**XCA Certificate Database** — the complete certificate authority used to manage all SSL certificates.
**Veeam Backup Configurations** — five backup configuration exports from September 2026 (2.3 GB total), containing the full backup infrastructure layout.
**Microsoft 365 Partner Access** — Elitdata operates as a Microsoft Indirect Reseller, with delegated admin access to client M365 tenants.
**Employee Data** — vacation/absence records 2009-2025, driving logs, personal folders for all staff.
**NIS2 Compliance Documents & Incident Response Plan** — ironically, their own security documentation is part of the breach.
—
## Client 1: Advokatfirman Kurt Lundberg HB — Law Firm
**122 GB | 204,000 files | Org.nr 559218-5713**
This is the most sensitive dataset. Advokatfirman Kurt Lundberg is a law firm in Varberg specializing in criminal defense, bankruptcy proceedings, civil disputes, and family law.
The exposed data includes the **complete case archive** of the firm:
### Criminal Defense Cases — 26,871 files
The criminal defense archive contains named defendants with their:
– Full police investigation reports (FUP — förundersökningsprotokoll)
– Attorney defense notes and strategy documents
– Personal identity documents and passport copies
– Court case references (Varbergs Tingsrätt, Göteborgs Tingsrätt)
– Phone call logs between attorney and client
– Evidence files including USB phone extractions
Case types include aggravated tax fraud (grovt skattebrott), civil registration fraud (folkbokföringsbrott), assault, drug offenses, and multiple migration/asylum cases.
### Bankruptcy Proceedings — 110,973 files
Complete legal files for 20+ company bankruptcies, including:
– Creditor lists and debt inventories
– Asset valuations and estate inventories
– Creditsafe credit reports
– Court filings and distribution plans
– Wage guarantee (lönegaranti) documents for affected employees
### Civil Disputes & Family Law — 20,807 files
– Civil lawsuits and insurance claims
– Inheritance distributions (arvskiften)
– Guardianship cases (God Man)
– Custody matters
– Estate administration (dödsbon)
### Attorney Communications
– Email archives (PST) totaling approximately 15 GB
– Internal correspondence between lawyers
– Client communication records
### Financial Records
– Complete SIE accounting files 2020-2026
– Payroll records (Visma Lön 300) for 2021-2024, including a separate file for “Advokatfirman Anton Karlsson AB”
– Balance reports and general ledger entries
**Identified attorneys and staff:** Anton Karlsson (primary case attorney), Sofia (disputes/family law), Henrik, Anders, Krister, Peter, Tina, Ing-Mari, Ulla, Kurt Lundberg (founding partner).
—
## Client 2: Artwood AB — Furniture & Design
**205 GB | 327,000 files**
Artwood AB is a Swedish furniture and home décor company with international sales across Scandinavia, Europe, and New Zealand.
The exposed data includes their **complete business operation:**
– **Purchasing** (55,684 files) — supplier contracts, purchase orders, pricing structures with factories
– **Sales** (15,058 files) — complete customer lists, pricing, order history
– **Marketing** (33,969 files) — product catalogs, campaigns, promotional materials
– **Complete ERP backup** (54,916 files) — Pyramid ERP system with full database
– **3D product renders** (19,407 files) — entire 2026 product line in 3D
– **Employee data** — phone list of all employees, email lists, personnel records, anniversary tracking
– **EU Deforestation Regulation** (EUDR) compliance documentation
**From Elitdata’s client folder for Artwood:**
– VPN configuration file (Artwood.tgb)
– Complete firewall configuration (startup-config.conf)
– SSL certificate for mail.artwood.se with private key
– GDPR Data Processing Agreement (Personuppgiftsbiträdesavtal)
– Incident report templates
A competitor with access to this data would gain complete visibility into Artwood’s supplier network, pricing strategy, customer base, and product pipeline.
—
## Client 3: Mantum Group — Logistics & Construction Conglomerate
**263 GB | 129 files (all SQL databases)**
Mantum is a Swedish conglomerate operating across logistics, construction, and transportation through multiple subsidiaries. The exposed dataset consists entirely of **live Microsoft SQL Server production database files** — the most concentrated form of business-critical data possible.
### Databases:
| Database | Size | Contents |
|—|—|—|
| BC140.mdf | 103 GB | **Microsoft Business Central PRODUCTION** — complete ERP |
| RamosMantumProd.mdf | 28 GB | Production management system |
| Flow_Mantum (6 instances) | 82 GB | Manufacturing/logistics operations |
| Hogia_HR_Foundation | 2.7 GB | **HR database — employee records, contracts, personnummer** |
| Hogia_PBM (7 databases) | 1.7 GB | **Payroll & personnel management** |
| Hogia_Travel | 72 MB | Travel/expense management |
| Opter + Opter_Special | 8.2 GB | Transport/logistics management |
| Per-company accounting | ~600 MB | 10 subsidiaries, 7 years of data |
### Subsidiary companies exposed:
Mantum Entreprenad AB, Mantum Entreprenad i Sverige AB, Mantum Holding AB, Mantum Logistics, Mantum Special AB, Hyltebruks Transport AB, Veddige Åkeriaktiebolag, KC Holding, V Service AB, VAAB Service AB.
### Plaintext Credentials
From Elitdata’s client documentation for Mantum, a file titled “Användare.txt” contains plaintext credentials:
– **Microsoft 365 Global Admin:** admin@mantum.se
– WiFi network passwords for all Mantum SSIDs
– Aruba switch and access point admin credentials
– Application credentials for RAMOS production system
– Individual user credentials
These databases contain every financial transaction, employee record, salary payment, customer invoice, supplier payment, inventory movement, and logistics operation for the entire Mantum corporate group spanning 2018 through 2025.
—
## Why This Matters
### 1. Supply Chain Cascade
One IT provider. 198 client organizations. All exposed through a single point of failure. Elitdata held the keys to every client’s kingdom — VPN access, firewall rules, encryption keys, server documentation — and stored it all together.
### 2. Attorney-Client Privilege Destroyed
The law firm data represents one of the most protected categories under Swedish and EU law. Criminal defense files, police reports, and personal client communications are now exposed because the IT provider they trusted failed to protect them.
### 3. GDPR Nuclear Scenario
Elitdata serves as data processor (personuppgiftsbiträde) for all 198 clients. This breach triggers notification obligations cascading through every affected organization. The Swedish Authority for Privacy Protection (IMY) will need to assess GDPR violations not just for Elitdata, but potentially for each client that entrusted their data.
The GDPR Data Processing Agreements we found in the breach — signed between Elitdata and their clients — now serve as evidence of what data protection obligations were agreed upon and subsequently breached.
### 4. Active, Current Data
The most recent files are dated September 2026. Veeam backup configurations from September 17-21, 2026. VPN configurations updated August 2026. SIE accounting files for fiscal year 2025-2026. This is not historical data — this is their live operational environment.
—
## Data Available
The complete dataset (670 GB) is available for download and includes:
– Internal IT infrastructure documentation for 198 Swedish organizations
– Law firm complete case archive (criminal defense, bankruptcy, disputes, family law)
– Furniture company complete business data (ERP, purchasing, sales, HR)
– Logistics conglomerate SQL production databases (ERP, HR, payroll, accounting)
– SSL wildcard certificates with private keys
– VPN and firewall configurations for client networks
– Microsoft 365 delegated admin access documentation
– 29 years of operational records
—
*Contact us through our secure channel for any inquiries.*
- Group: inc ransom
- Discovered: 2026-11-10 22:33 UTC
This entry reflects a claim published by an extortion group and collected by a public tracker. It has not been independently verified.
Source: RansomLook — Recent Posts · 2026-11-10