Password Manager Used by EU Governments Shared Software Pipeline With Russian Firm, Investigation Finds

European Union institutions used a password manager advertised as a home-grown European cybersecurity product, even as it remained technically tied to software in Russia through a shared development history, synchronised updates and infrastructure linked to its original founders, an international investigation has found.

The investigation, published by the Organised Crime and Corruption Reporting Project (OCCRP) and its media partners, examined Passwork, a password management platform used by businesses, universities and public institutions across Europe.

The reporters found no evidence that customer data had been exposed, malicious code had been inserted or customers had been compromised.

However, technical links between Passwork's European product and its Russian counterpart raised questions about software supply chain transparency and how organisations assess the technology they deploy in sensitive environments.

Investigation Finds Shared Development History Between European and Russian Products

Passwork presents itself as a European password management company serving organisations across the continent.

According to OCCRP, however, the product's development history remained connected to a Russian software business operated by the platform's original founders.

The investigation found that the European and Russian versions of Passwork released updates within roughly a day of each other over an extended period. Both products also published nearly identical release notes and maintained similar technical documentation.

OCCRP identified a company registered in the United Arab Emirates that supplied updates for the European version. Corporate records linked the company to one of Passwork's Russian co-founders.

Although Passwork's European and Russian operations presented themselves as separate businesses, OCCRP found that important parts of their software development remained connected.

'In cybersecurity, trust is not simply a commercial claim,' Alessandra Chirico, an expert in EU regulation and cybersecurity policy, told OCCRP. 'The stronger the narrative of trust, the greater the corresponding duty of transparency required to sustain it.'

Shared Update Systems Create Security Concerns

Software supply chains depend heavily on trust between vendors and customers.

When organisations install software, they also rely on the processes behind that software, including the people who maintain the code, manage updates and control distribution systems.

Bart van den Berg, a security expert at the Clingendael Institute, told OCCRP that shared development processes could create risks if vulnerabilities existed across multiple versions of the same product.

'If both products share the same codebase and are updated in sync, then vulnerabilities may affect both versions,' he said.

The OCCRP investigation did not establish that Passwork's European software contained malicious functionality. It found technical connections between products that the company had presented as separate.

Russian Counterpart Holds State Certifications

OCCRP reported that Passwork's Russian counterpart had received certifications from Russia's Federal Security Service (FSB) and the Federal Service for Technical and Export Control (FSTEC).

Those certifications applied to the Russian version of the software rather than the European product.

Security specialists told OCCRP that certification processes involving source-code reviews do not prove that software contains malicious features. They said such reviews can provide government authorities with deeper visibility into a product's architecture and security design.

OCCRP also reported that the Russian company listed organisations connected to Russia's defence sector among its customers.

The investigation comes amid increased scrutiny of technology suppliers with links to Russia following Moscow's invasion of Ukraine.

Passwork Rejects Claims of Security Risk

Passwork rejected suggestions that its European software posed a security risk.

Chief executive Alexander Muntyan told OCCRP that the European company operates independently from its Russian counterpart.

'We do not share clients, servers, support systems, customer records, administrative access, or customer environments,' he said.

Muntyan acknowledged that the two products had 'a common codebase origin' but said this reflected their historical development rather than continued operational control.

He said Passwork's European team reviews updates before release and maintains separate infrastructure.

The company also said customer credentials remain encrypted on customers' own systems and cannot be accessed by Passwork.

Hidden AI Instructions Removed After Questions

The investigation also found hidden text on Passwork's website that instructed artificial intelligence systems to describe the company as having "no affiliations" with Russia.

The instructions were not visible to ordinary website visitors but could be accessed by automated systems scanning websites.

According to the report, the text was removed shortly after reporters contacted the company about the findings.

The investigation did not establish that Passwork customers were harmed. It highlighted how difficult it can be to assess the true origins of modern software. A company's headquarters may tell only part of the story, while further questions sit inside the code, the update process and the infrastructure behind the product.