Multiple Irish State agencies are using password software with deep links to a Russian technology company licensed by Moscow’s intelligence service, an Irish Times investigation has found.
The use of this password manager software by State bodies, including those involved in the handling of sensitive information, raises serious security concerns, according to experts.
The software, which is sold by the Spanish company Passwork Europe SL, allows clients to securely store and manage users’ passwords.
On its website, Passwork says it is an entirely EU-founded company. However, the product shares striking similarities with software of the same name which first appeared in Russia 12 years ago. Similarities include the original source code, update schedules, identical user manuals and even the companies’ logos.
RM Block
At least one of the original founders of the Russian company continues to play a role in the Spanish-based version. Until recently, they also shared the same web hosting, mail server and marketing accounts.
At least three Irish Government agencies use Passwork Europe for managing their employees’ passwords. All three said they were reviewing their use of the password software on the back of queries raised by The Irish Times.
The Irish State Laboratory, which provides chemical testing and scientific advice to Government departments, started using the software in 2024.
The Office of Public Works (OPW), which manages State buildings, has used Passwork since 2022. It said that, following queries from The Irish Times, it has consulted with the National Cyber Security Centre, which identified no risks, but the OPW is exploring “future options”.
The Competition and Consumer Protection Commission (CCPC), which enforces businesses and consumer law, also said it started using the Finnish version of Passwork software in 2022 before moving to the Spanish company “on the understanding it was EU based”.
The Department of Culture, Communications and Sport declined to confirm or deny use of the software for security reasons.
A spokeswoman for the State Laboratory said queries from The Irish Times have “highlighted a new potential risk that is being treated seriously”. She added: “As such, we are reviewing the product and any associated risk or concern.”
The findings are based on an investigation carried out by The Irish Times in co-operation with European media outlets including the Organised Crime and Corruption Reporting Project (OCCRP), Le Monde in France and Infolibre in Spain.
The Irish Times submitted some 100 Freedom of Information requests to determine the extent of the State’s use of Passwork, while reporters asked cybersecurity experts to review Passwork technical data to determine the similarities between the entities.
The company was originally founded in the northern Russian city of Arkhangelsk by two Russian nationals Ilya Garakh and Andrey Pyankov. With the help of an investor with close links to the Kremlin at the time, it set up an Finnish version in 2017.
In 2022, the Russian founders set up another company called Passwork in Russia while also becoming involved in a fourth company of the same name in the United Arab Emirates (UAE).
The Russian version sells exclusively to Russian clients, including EU-sanctioned companies which manufacture arms for the Russian military. It is also certified by the FSB, Russia’s main domestic security agency, and Russia’s ministry of defence, a process which requires the source code to be inspected by security officials.
Alexander Muntyan, the Russian owner of Passwork in Spain, denied any link between the Russian and European version of Passwork, when contacted by the investigation. He said he purchased the software rights from the UAE company and any similarities to other versions of Passwork are merely administrative holdovers.
He also rejected the idea that customers may be at risk due to the Russian connections.
However, Muntyan did acknowledge Garakh, the co-founder of the Russian Passwork, has been providing “limited product related knowledge-transfer support” during a two-year transition period which ends in August 2026.
The Irish Times investigations unit
- This story was produced by The Irish Times Investigations Unit.
- If you have a story tip, contact us here.
