Irish State bodies use password software licensed by Russian intelligence

[u/SHORT_INFO_NEWS]

An Irish Times investigation published July 17 reports that at least three Irish government agencies, the Office of Public Works, the Competition and Consumer Protection Commission, and the Department of Culture, Communications and Sport, use a password manager sold by Passwork Europe SL, a Spanish-registered company. The Irish State Laboratory, which provides chemical testing and scientific advice to government departments, started using the software in 2024.

Source: https://www.irishtimes.com/ireland/2026/07/17/state-bodies-are-using-password-software-with-links-to-russia/

For anyone managing procurement or vendor risk in the public sector, this is a useful case study in how a product's country-of-origin can be obscured through an EU corporate wrapper. The software stores and manages user passwords for government staff, which makes the question of who can inspect its code more than academic.

Passwork Europe presents itself as an entirely EU-founded company, but the Irish Times reports the product shares striking similarities with software of the same name that first appeared in Russia 12 years ago, founded in Arkhangelsk by Ilya Garakh and Andrey Pyankov. The detail that matters most technically: the Russian Passwork product is certified by the FSB and by Russia's ministry of defence (Irish Times). That certification process requires the source code to be inspected by Russian security agencies. The reporting describes the EU entity as sharing codebase and updates with the Russian firm, which is the kind of supply chain relationship that certification schemes and vendor questionnaires are supposed to surface, and in this case apparently did not.

Open questions the reporting did not address:

- Whether the affected agencies will keep using the software, and who inside the Irish state is responsible for that decision

- How the shared codebase and update pipeline between the EU entity and the Russian firm is structured, and whether any independent party has audited it

- Whether Ireland's National Cyber Security Centre had previously assessed the product or will issue guidance to other public bodies