Concerns Raised Over Irish State Agencies Using Russian-Linked Password Software

London, United Kingdom Jul 17, 2026 ALN: Concerns have been raised regarding the use of password management software by multiple Irish State agencies, which is linked to a Russian technology company that has connections with Moscow’s intelligence services. This revelation comes from a thorough investigation that has sparked significant debate about the security implications of utilizing such software in government operations, especially those that handle sensitive information.

The software in question is marketed by Passwork Europe SL, a company that claims to be fully founded within the European Union. Despite these assertions, the investigation has uncovered compelling evidence suggesting that the software bears striking resemblances to an earlier version that originated in Russia over a decade ago. Key similarities include the original source code, identical update schedules, user manuals, and even logos, raising questions about the authenticity and security of the product being used by Irish agencies.

At the heart of the issue is the fact that at least one of the original founders of the Russian version of Passwork continues to have an active role in the Spanish-based iteration. This connection is further complicated by the fact that until recently, both versions of the software shared the same web hosting services, mail servers, and marketing accounts, suggesting a closer relationship than Passwork Europe SL has publicly acknowledged.

Currently, at least three Irish Government agencies are reported to be utilizing the Passwork Europe software for password management. These agencies include the Irish State Laboratory, which offers chemical testing and scientific advice to various government departments, the Office of Public Works (OPW), responsible for managing State buildings, and the Competition and Consumer Protection Commission (CCPC), which enforces business and consumer law. Following inquiries prompted by this investigation, all three agencies have indicated that they are reviewing their use of the software, reflecting the seriousness of the security concerns raised.

The Irish State Laboratory began using this password management software in 2024, while the OPW has been using it since 2022. The OPW has stated that it consulted with the National Cyber Security Centre after the investigation raised questions, and although the Centre identified no immediate risks, the OPW is still exploring future options regarding their password management solutions. Meanwhile, the CCPC confirmed that it transitioned to the Spanish version of Passwork in 2022, believing it to be EU-based, having previously used a Finnish version.

In a more cautious stance, the Department of Culture, Communications and Sport has refrained from confirming or denying the use of the software, citing security reasons. This lack of transparency adds to the growing unease surrounding the use of the password manager by agencies that handle sensitive data.

A spokeswoman for the Irish State Laboratory acknowledged that the inquiries have revealed a “new potential risk” that is being taken seriously. The agency is currently reviewing the product and any associated risks or concerns, indicating a proactive approach to safeguarding sensitive information.

The investigation that unveiled these connections was conducted in collaboration with various European media outlets, including the Organised Crime and Corruption Reporting Project (OCCRP), Le Monde in France, and Infolibre in Spain. It involved submitting approximately 100 Freedom of Information requests to ascertain the extent of the State’s reliance on Passwork software, as well as engaging cybersecurity experts to analyze the technical data of Passwork to identify the similarities between the different versions.

Passwork was initially founded in Arkhangelsk, Russia, by two Russian nationals, Ilya Garakh and Andrey Pyankov. In 2017, with the assistance of an investor linked to the Kremlin, they established a Finnish version of the software. In 2022, the founders launched another company under the same name in Russia while also becoming involved in a fourth version based in the United Arab Emirates (UAE). The Russian variant of Passwork is known to sell exclusively to Russian clients, including companies that are subject to EU sanctions and are involved in the manufacturing of arms for the Russian military. Notably, this Russian version is certified by the FSB, Russia’s main domestic security agency, and the Ministry of Defence, a certification process that requires scrutiny of the source code by security officials.

In response to the investigation, Alexander Muntyan, the Russian owner of Passwork Europe, denied any connections between the Russian and European versions of the software. He asserted that he acquired the rights to the software from the UAE company and dismissed the similarities as mere administrative remnants. Muntyan also downplayed the potential risks to customers stemming from these Russian ties.

However, he did acknowledge that Garakh, the co-founder of the Russian Passwork, has been providing “limited product-related knowledge-transfer support” during a transition period that is set to conclude in August 2026. This admission raises further questions about the extent of influence the original Russian founders still hold over the software being used by Irish State agencies.

The implications of these findings are significant, especially as they relate to national security and the protection of sensitive information within government bodies. As cyber threats continue to evolve, the reliance on software with questionable origins could expose governmental operations to vulnerabilities. The investigation highlights the importance of thorough vetting and transparency in the procurement of technology solutions used by public institutions.

In light of these developments, it is likely that Irish State agencies will face increased scrutiny regarding their cybersecurity practices and the tools they employ to manage sensitive information. The ongoing review of the use of Passwork software by these agencies is a critical step towards ensuring that they maintain the highest standards of security and protect against potential threats arising from foreign connections. As the situation unfolds, it may prompt broader discussions about the security protocols in place across public sectors in Ireland and the need for stringent measures to safeguard against risks associated with foreign technology.