A €165 million (about 1.9 billion Norwegian kroner) takeover of Swedish software maker Myrbyte has revealed that records sold as anonymous could be matched to named users through a concealed account-recovery feature. The data include searches and service requests handled by 31 municipal customers, according to figures presented at a public merger hearing in Oslo on Monday.
The buyer, Norwegian cloud company Vardelink, said its technical team found the link during checks ahead of a planned migration. Its review counted 1.4 million profiles created since 2022 and 2.8 million recorded searches. Vardelink has paused the transfer of Myrbyte’s data systems while it assesses what access the feature allowed.
The key hidden in the system
Myrbyte marketed its software to councils as a way to examine patterns in public-service demand without identifying residents. But a recovery token, designed to help users regain access to accounts, remained attached to activity records. When combined with account details held by a municipality, the token could point back to a named person, Vardelink told the hearing.
The buyer said it had confirmed that 640,000 profiles could be matched against records already supplied by participating municipalities. That does not establish that anyone used the link to identify residents, and Vardelink said it had found no evidence of bulk searches for individual users. The review did not determine how many staff accounts could reach the relevant data.
“People were promised anonymous statistics, but the system kept a door back to the person,” said Katarina Šviesė, a privacy researcher at the Oslo Centre for Digital Rights. “That is not a minor technical footnote when councils use the service to plan support.”
People were promised anonymous statistics, but the system kept a door back to the person.
Katarina Šviesė, privacy researcher
Customers demand answers
Myrbyte disputed the suggestion that the records were exposed to the public. Its chief privacy officer, Josefina O’Reilly, said the recovery feature was restricted to authorised support functions and that the company had not sold identifiable user histories. “We are checking every access log with our municipal customers, and we have suspended the feature until that work is complete,” she said.
Several customers use the software to track requests for housing advice, debt counselling and local benefits. One municipal IT manager, who asked not to be identified because their council had not authorised public comment, said the service had been described as anonymous during procurement. The manager said officials had begun checking access records and had contacted their data-protection staff.
The Norwegian Data Stewardship Authority said it had opened a formal review and would require both companies to preserve relevant access logs. Its director, Ramūnas Bonifacas, said the authority would examine whether the original privacy claims matched the system’s design and whether residents must be notified. The review is expected to issue an initial assessment within six weeks.
Vardelink’s acquisition, announced on 29 September, is still awaiting approval from competition officials. The company says it will not complete the migration until the review is finished; Myrbyte has offered customers a temporary export of their records. For municipalities, the immediate problem is practical as well as legal: they must keep services running while deciding whether the software can still be trusted.
