8 ms·

Ok, some important context for non-Swedes. Anyone can get access to all Swedish (non-protected but those are a very VERY small subset) personal identification n

Ok, some important context for non-Swedes. Anyone can get access to all Swedish (non-protected but those are a very VERY small subset) personal identification numbers by simply signing an agreement with SPAR[1] (the Swedish national people database). Identification numbers per se are not particularly useful or hard to get, they are effectively public information. Using SPAR you can also get the home (and any additional) addresses of individuals A Swedish citizen database is... you know. fun. But not exactly hard to get hold of. [1] https://www.statenspersonadressregister.se/master/start/english-summary/ https://www.statenspersonadressregister.se/master/start/engl...

petcat 7mo ago
> by simply signing an agreement with SPAR But that seems like a completely different thing than a nefarious and anonymous person or group having access to the entire database.
- wayfwdmachine 7mo ago
  Yeah, nefarious or anonymous people have never used the internet so they could never find out that this was all public information.
  - petcat 7mo ago
    public information if they signed an agreement with the Swedish government?
    - einr 7mo ago
      No, public information for anyone. You realize that if it's public information, then it's public, and anyone can re-publish it online? There are websites for that. I can get the complete identification number, home address, phone number, etc for any Swedish citizen (that does not have a protected identity) in less than a minute.
      - petcat 7mo ago
        You can get all of that one-by-one? Or can you get the whole database at once?
        einr 7mo ago
        I cannot trivially get the whole database, no. But I kind of fail to see what a malicious actor would do with a large database of public information that they couldn’t otherwise do. The system is designed such that you can’t really do a lot of malicious stuff with just public data, and the stuff you can do (scam calls, etc) is probably not meaningfully more effective if you have the whole database than if you do manual lookups or web scraping. I’m open to being proved wrong about that however. Basically: obviously it's not desirable to have that full database in the hands of a malicious actor but I'm not sure it's such a big deal either. Again, it's public data by design.
        hrimfaxi 7mo ago
        In the US, property tax records are public by design. However, historically the records were physical and hard to search through. Now that these records are digitized and published online, it is trivial to find out where someone resides by searching through these records. So while public by design, at scale data aggregation changes the threat model.
        kevin_thibedeau 7mo ago
        Phone books gave out most people's home address. There were data brokers transcribing them (before reliable OCR) to build their databases.
        dworks 7mo ago
        You can trivially purchase the data from Bisnode Dun & Bradstreet Sverige.
        Saline9515 7mo ago
        Identity theft and scams are widespread in Sweden and the most increasing crime currently. https://ocindex.net/assets/downloads/2025/english/ocindex_profile_sweden_2025.pdf https://ocindex.net/assets/downloads/2025/english/ocindex_pr...
picafrost 7mo ago
I think this is good to highlight for non-Scandinavians. Scandinavian countries are extremely open and transparent in a way that might be shocking for Americans. For example, in Norway, I can check nearly anyone's brokerage account holdings, addresses, phone numbers, etc. on public websites. I can in theory look up anyone's tax filings. Personal identification numbers do not tend to be considered private in the same way that social security numbers in the US are.
- ahoka 7mo ago
  Not open but stupid, IMHO.
- whynotmaybe 7mo ago
  I heard a rumor that some people use this to check their neighbour's revenue and sometimes make snark comments if one of them has a high revenue but lives in a "average revenue" part of town. They'd say that if you earn a lot, you shouldn't take a cheap housing. Any truth to that?
  - sorum 7mo ago
    Yep, that tracks. There's also the underlying current of Jantelagen (Law of Jante) https://en.wikipedia.org/wiki/Law_of_Jante https://en.wikipedia.org/wiki/Law_of_Jante
  - internet_points 7mo ago
    Making snark comments about that sounds very unlikely. More likely they'd have respect for someone living frugally and not showing off. See https://en.wikipedia.org/wiki/Law_of_Jante https://en.wikipedia.org/wiki/Law_of_Jante
  - ale 7mo ago
    Yes and no. You get notified if someone else actually asks for your revenue info and so in practice nobody actually does it.
    - 7mo ago
einr 7mo ago
Identification numbers per se are not particularly useful or hard to get, they are effectively public information They are absolutely trivial to get. One click on mrkoll.se.
lysace 7mo ago
That might be interesting but it’s also completely irrelevant since no PII was actually leaked. Also, no source code of ”Swedish e-government services” was leaked since that is not a thing: https://news.ycombinator.com/item?id=47363966 https://news.ycombinator.com/item?id=47363966

petcat 7mo ago

> by simply signing an agreement with SPAR But that seems like a completely different thing than a nefarious and anonymous person or group having access to the entire database.

wayfwdmachine 7mo ago
Yeah, nefarious or anonymous people have never used the internet so they could never find out that this was all public information.
- petcat 7mo ago
  public information if they signed an agreement with the Swedish government?
  - einr 7mo ago
    No, public information for anyone. You realize that if it's public information, then it's public, and anyone can re-publish it online? There are websites for that. I can get the complete identification number, home address, phone number, etc for any Swedish citizen (that does not have a protected identity) in less than a minute.
    - petcat 7mo ago
      You can get all of that one-by-one? Or can you get the whole database at once?
      - einr 7mo ago
        I cannot trivially get the whole database, no. But I kind of fail to see what a malicious actor would do with a large database of public information that they couldn’t otherwise do. The system is designed such that you can’t really do a lot of malicious stuff with just public data, and the stuff you can do (scam calls, etc) is probably not meaningfully more effective if you have the whole database than if you do manual lookups or web scraping. I’m open to being proved wrong about that however. Basically: obviously it's not desirable to have that full database in the hands of a malicious actor but I'm not sure it's such a big deal either. Again, it's public data by design.
        hrimfaxi 7mo ago
        In the US, property tax records are public by design. However, historically the records were physical and hard to search through. Now that these records are digitized and published online, it is trivial to find out where someone resides by searching through these records. So while public by design, at scale data aggregation changes the threat model.
        kevin_thibedeau 7mo ago
        Phone books gave out most people's home address. There were data brokers transcribing them (before reliable OCR) to build their databases.
        dworks 7mo ago
        You can trivially purchase the data from Bisnode Dun & Bradstreet Sverige.
        Saline9515 7mo ago
        Identity theft and scams are widespread in Sweden and the most increasing crime currently. https://ocindex.net/assets/downloads/2025/english/ocindex_profile_sweden_2025.pdf https://ocindex.net/assets/downloads/2025/english/ocindex_pr...

picafrost 7mo ago

I think this is good to highlight for non-Scandinavians. Scandinavian countries are extremely open and transparent in a way that might be shocking for Americans. For example, in Norway, I can check nearly anyone's brokerage account holdings, addresses, phone numbers, etc. on public websites. I can in theory look up anyone's tax filings. Personal identification numbers do not tend to be considered private in the same way that social security numbers in the US are.

ahoka 7mo ago
Not open but stupid, IMHO.
whynotmaybe 7mo ago
I heard a rumor that some people use this to check their neighbour's revenue and sometimes make snark comments if one of them has a high revenue but lives in a "average revenue" part of town. They'd say that if you earn a lot, you shouldn't take a cheap housing. Any truth to that?
- sorum 7mo ago
  Yep, that tracks. There's also the underlying current of Jantelagen (Law of Jante) https://en.wikipedia.org/wiki/Law_of_Jante https://en.wikipedia.org/wiki/Law_of_Jante
- internet_points 7mo ago
  Making snark comments about that sounds very unlikely. More likely they'd have respect for someone living frugally and not showing off. See https://en.wikipedia.org/wiki/Law_of_Jante https://en.wikipedia.org/wiki/Law_of_Jante
- ale 7mo ago
  Yes and no. You get notified if someone else actually asks for your revenue info and so in practice nobody actually does it.
  - 7mo ago

einr 7mo ago

Identification numbers per se are not particularly useful or hard to get, they are effectively public information They are absolutely trivial to get. One click on mrkoll.se.

lysace 7mo ago

That might be interesting but it’s also completely irrelevant since no PII was actually leaked. Also, no source code of ”Swedish e-government services” was leaked since that is not a thing: https://news.ycombinator.com/item?id=47363966 https://news.ycombinator.com/item?id=47363966