Dustin security chief explains how attackers gained access

Dustin’s Group CISO, Dennie Karlsson, says a development mistake exposed secrets that attackers used to access some of the company’s systems and take data. He spoke to Techtidningen after a presentation at Dell Technologies Forum in Stockholm.

Dustin shut down parts of its IT systems on 3 September after detecting unauthorized access. Trade and deliveries stopped. Customers could order again by phone and email five days later, and all websites and ordering portals were back to normal on 10 September.

The hacker group FulcrumSec claimed it obtained 6.2 terabytes of data and began publishing material. Techtidningen said it could not verify the material’s authenticity or scope. Karlsson said the breach involved data theft and extortion, not system encryption. Dustin shut down parts of its environment and restarted them under controlled conditions. The company has mapped the attack, closed access routes, replaced credentials and is still investigating how much data was exposed.

Karlsson said information from the company’s case management system had leaked. He sees the greatest risk to Dustin itself: attackers could use details from real cases to make deceptive requests seem credible. He also said Dustin is reviewing why years-old records remained in the system, which had been used as a knowledge base despite the company having a separate tool for that purpose.

During the response, Dustin used AI models to review large amounts of unstructured, unclassified data. Karlsson said early results looked promising, but after a few days the analysis missed obvious items and could not be trusted. He also described the strain of an incident lasting weeks: Dustin’s plans helped, but its staffing had to expand as the work continued into the second and third weeks.