Passwork, a Spain-based password manager used by European government agencies and universities, shares technological origins and updates with a Russian counterpart certified by Russian defense intelligence agency FSTEC and FSB. The Russian company serves sanctioned Russian clients including missile manufacturers. The Spanish company receives software updates from a UAE-based firm managed by one of Passwork's Russian co-founders. The Spanish CEO denies operational ties or data sharing with the Russian entity, citing separate servers and client data storage, but acknowledges a common software codebase and similar update timelines. Experts warn that the Russian entity's certification involves deep source-code review which may expose vulnerabilities or backdoors, posing a state-level risk to European clients. Several European clients were unaware of the Russian links. The product originated as a startup in Arkhangelsk, Russia in 2014 and later moved through Finland, UAE, and finally Spain due to geopolitical pressure and sanctions resulting from Russia's invasion of Ukraine in 2022. The company faced skepticism due to its Russian origins, sought official European registration and infrastructure, and transferred rights over time. Experts warn that the shared codebase and synchronized updates create a shallow technical firewall and pose cybersecurity risks, including the potential for malicious software updates as a covert attack vector. The investigation was published by OCCRP and partners on 2026-07-18.

Passwork, a Spain-based password manager used by European government agencies and universities, shares technological origins and updates with a Russian counterpart certified by Russian defense intelligence agency FSTEC and FSB. The Russian company serves sanctioned Russian clients including missile manufacturers. The Spanish company receives software updates from a UAE-based firm managed by one of Passwork's Russian co-founders. The Spanish CEO denies operational ties or data sharing with the Russian entity, citing separate servers and client data storage, but acknowledges a common software codebase and similar update timelines. Experts warn that the Russian entity's certification involves deep source-code review which may expose vulnerabilities or backdoors, posing a state-level risk to European clients. Several European clients were unaware of the Russian links. The product originated as a startup in Arkhangelsk, Russia in 2014 and later moved through Finland, UAE, and finally Spain due to geopolitical pressure and sanctions resulting from Russia's invasion of Ukraine in 2022. The company faced skepticism due to its Russian origins, sought official European registration and infrastructure, and transferred rights over time. Experts warn that the shared codebase and synchronized updates create a shallow technical firewall and pose cybersecurity risks, including the potential for malicious software updates as a covert attack vector. The investigation was published by OCCRP and partners on 2026-07-18.