Swedish Arts Council listed on RansomHouse leak site

• Ransomware group: RansomHouse
• Country: Sweden
• Sector: Government & Defense
• Announcement date: November 24, 2025

The RansomHouse ransomware group has claimed to have published data belonging to the Swedish Arts Council on its dedicated leak site. According to the announcement made by the threat actor, the organization has been targeted in a cyberattack, potentially exposing sensitive information. The listing appeared on the group's platform on November 24, 2025.

The claims made by RansomHouse

The threat actor known as RansomHouse alleges that a significant security incident occurred within the IT systems of the Swedish Arts Council on October 31, 2025. In their public announcement, the group has leveled accusations against the agency's management, claiming that they attempted to conceal the incident from the public or relevant authorities.

RansomHouse has used this platform to warn that confidential data and various project documents may be leaked as a result of the breach. This type of tactic is common in modern ransomware operations, where threat actors utilize double extortion methods. In such scenarios, attackers do not merely encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage for extortion. By threatening to release stolen files on a public leak site, the attackers aim to pressure the victim into paying a ransom to prevent the exposure of their private data.

Information regarding the leaked data

While the RansomHouse group claims that they have successfully obtained confidential data and project documents, they have not provided a detailed list or a specific inventory of the leaked data types. No information was provided regarding the total volume of the data stolen or the specific file count involved in the incident.

The listing names no specific data types in a detailed list.

The Swedish Arts Council profile

The Swedish Arts Council (Kulturrådet) is a Swedish government agency. It is responsible for implementing national cultural policy, promoting cultural development, and providing funding for various art forms. The agency operates across multiple sectors, including music, literature, visual arts, and performing arts, with the primary goal of enhancing cultural collaboration and accessibility.

Potential implications and organizational risks

This incident may indicate a significant risk of exposure for the agency's administrative and project-related sensitive data. Because the Swedish Arts Council is a Swedish-based entity, any confirmed data breaches could lead to legal consequences under the EU General Data Protection Regulation (GDPR). Organizations operating within the European Union must adhere to strict protocols regarding the protection of personal data and the timely reporting of breaches to ensure compliance with these regulations.

The RansomHouse group is known to have focused on data exfiltration and extortion since 2021. This specific situation may lead to reputational damage and could potentially result in secondary attacks against the organization. For a public service provider like the Swedish Arts Council, a breach of this nature could potentially create negative impacts on its supply chain and its various cultural collaborations.

To mitigate such risks, organizations in the government and public service sectors often implement defensive strategies such as robust backup solutions, multi-factor authentication, and continuous monitoring of network traffic. Strengthening supply chain security and ensuring that all partners adhere to strict cybersecurity standards is also a vital component in protecting the integrity of public cultural institutions and their collaborative networks.