DATACARRY
A little-documented extortion group first seen in May 2025. It is known mainly for publishing data stolen from Swedish IT supplier Miljödata, an incident that affected many public bodies.
Threat actor profile. Last reviewed 3 November 2026.
Why It Matters
Few credible public sources cover this name. This page states only what they support, so gaps here do not mean the group lacks those capabilities.
The Miljödata case is a supply chain lesson. BleepingComputer reports that the firm supplies IT systems to about 80% of Sweden's municipalities and that the attack disrupted services in several regions.1
Sweden's privacy regulator, IMY, is investigating data on about 1.5 million people, and is looking at how public bodies handled data in the system as well as at Miljödata's own security.1,3 Have I Been Pwned counts about 870,000 affected, so the figures differ.1
The sources we reviewed do not establish a UK link.
Customers of a breached supplier faced regulatory questions of their own here. We would check what former employee and sensitive data your suppliers still hold.
Vulnerabilities
The sources we reviewed do not tie a CVE to DATACARRY.
Defences That Matter
Ask Suppliers Hard Questions
- Check what personal data HR and other suppliers hold on your behalf, including former staff.
- Agree retention limits and breach notification terms.
Prepare for a Supplier Breach
- Rehearse an incident where the attacker is in a supplier, not your network.
- Know who would notify your regulator and when.
What Do Your Suppliers Hold on Your Staff?
We can help you assess supplier risk and plan for a breach that starts outside your network.
Sources
- BleepingComputer: Data breach at major Swedish software supplier impacts 1.5 million, 4 November 2025
- teiss: DataCarry ransomware group breaches Swedish IT company Miljödata, steals confidential data, 2 October 2025
- teiss: IMY probes Miljödata cyber attack affecting 1.5 million people, 5 November 2025