State agencies cease use of Russian-linked cybersecurity service following investigation

Irish State agencies have ceased using a cybersecurity service following the publication of an Irish Times investigation showing links to a Russian technology company licensed by Moscow’s intelligence service.

The software, Passwork, allows clients to securely store and manage user passwords.

It is sold by a Spanish based company but the investigation published last July found it shared striking similarities with software of the same name which first appeared in Russia 12 years ago.

Similarities include the original source code, update schedules, identical user manuals and even the companies’ logos.

At least one of the original founders of the Russian company continues to play a role in the Spanish based version. Until recently, they also shared the same web hosting, mail server and marketing accounts.

The Russian version sells exclusively to Russian clients, including EU-sanctioned companies which manufacture arms for the Russian military. It is also certified by the FSB, Russia’s main domestic security agency, and Russia’s ministry of defence, a process which requires the source code to be inspected by security officials.

[ How Russian password technology got into Irish State agenciesOpens in new window ]

The investigation by The Irish Times, in co-operation with European media outlets including the Organised Crime and Corruption Reporting Project (OCCRP), Le Monde in France and Infolibre in Spain, found at least three Irish State agencies were using the software.

The Irish State Laboratory, which provides chemical testing and scientific advice to Government departments, began using it in 2024.

The Office of Public Works (OPW), which manages State buildings, including those of the Garda, began using Passwork in 2022 as did the Competition and Consumer Protection Commission, which enforces businesses and consumer law.

After becoming aware of the Russian links, State agencies consulted with the National Cyber Security Centre, which identified no risks.

However, all three agencies have now said they have ceased use of the software.

A spokeswoman for the State Laboratory said it ceased using Passwork in July.

“A potential security vulnerability was highlighted by The Irish Times,” she said. “This was taken into account as part of ongoing IT security, best practice, and Government guidance. The State Laboratory has found no evidence that any data was compromised by using this software.”

The OPW said that “following a recent cybersecurity review” it has deployed “a new on-premise credential management system to replace Passwork. The new solution will be managed on-premise by the OPW cyber security team.”

Passwork was originally founded in the northern Russian city of Arkhangelsk by two Russian nationals Ilya Garakh and Andrey Pyankov.

Other versions were later established in Finland and the United Arab Emirates (UAE).

Last July, Alexander Muntyan, the Russian owner of Passwork in Spain, denied any link between the Russian and European version of Passwork. He said he purchased the software rights from the UAE company and any similarities to other versions of Passwork are merely administrative holdovers.

He also rejected the idea that customers may be at risk due to the Russian connections.

However, Muntyan did acknowledge Garakh, the co-founder of the Russian Passwork, has been providing “limited product related knowledge-transfer support” during a two-year transition period which ends in August 2026.