A joint investigation has revealed that the password manager Passwork, which markets itself as a product “made in Europe”, has Russian origins.
The company Passwork, which offers secure password storage services and has ties to Russia, has been used by critical European businesses and government institutions, raising potential cybersecurity risks. This finding comes from a joint investigation by Investico, NU.nl, De Groene Amsterdammer, Le Monde, and De Tijd, as reported by Cybernews.
True origins and Russian connections
On its English-language website, Passwork claims to be a Finnish company founded in 2017 that recently relocated its headquarters to Barcelona. The service is promoted as “made in the EU” and asserts compliance with GDPR and NIS2 requirements. “Developed in Europe, fully GDPR and NIS2 compliant with data sovereignty”, the website states.
However, the investigation indicates that Passwork was actually created in Russia as early as 2014, and following Russia’s full-scale invasion of Ukraine, the company was transferred to Spain. The Russian version of the software remains available in the country, where it is utilized by major state-owned enterprises, including Gazprom and Transneft. Users also include the Russian Ministry of Defense and the FSB.
Risks for European businesses and governments
Bart van den Berg, head of the security department at the Clingendael Institute, told Investico that the Russian connections could provide the Kremlin with a “broad understanding of the software and its vulnerabilities”. Furthermore, due to the technical similarities between the European and Russian versions of Passwork, Moscow could potentially exploit identified weaknesses to target European companies.
Among the service’s clients are critical European enterprises, including the large Dutch solar park operator Novar, a French port operator, and Irish government institutions. According to van den Berg, Novar is an attractive target for hostile states, as gaining control over its solar power plants could lead to large-scale power outages in the Netherlands. “This is much more effective than an airplane or a bomb”, he said.
The CEO of Passwork, Oleksandr Muntian, informed investigators that the company obtained a license to sell the product in Europe through a structure registered in the UAE, managed by Russian founders. He stated that the service uses servers located in Germany and does not exchange “servers, customer data, or other systems” with the Russian company.
This is not the first time that software linked to Russia has raised concerns in Europe. The service Euro-Office, launched in June 2026 and marketed as a European alternative to Microsoft 365 and Google Docs, has also come under scrutiny because it is a fork of OnlyOffice. The company developing OnlyOffice is now registered in Latvia, but the software itself originates from Russia, prompting questions about Euro-Office‘s claims of digital sovereignty and potential security risks.
Source: Cybernews
