On Friday 5 May 2023, a Telegram channel called Poufna Rozmowa ("Confidential Conversation") published an email from July 2020 that contained a link, a login and a password for an account on ArcGIS, the cloud mapping platform. The email had been sent unencrypted by a manager at Esri Polska, the Polish branch of the company behind ArcGIS, to a deputy director of Poland's Government Centre for Security. It was later forwarded to the private mailbox of minister Michał Dworczyk, from which it was stolen along with thousands of other emails. The Polish investigative outlet OKO.press found that the three-year-old password still worked. Behind it were folders for public sector clients, including a detailed map of the naval port in Gdynia, military map overlays and a Warsaw flood evacuation plan. The password was changed only hours after publication.
Key takeaways
- A login and password for an ArcGIS account were sent in plain text, in the same email as the link they unlocked, in July 2020.
- The email ended up in stolen correspondence that Poufna Rozmowa has published since 2021; Polish findings point to Belarusian and Russian services behind the mailbox hacks, according to OKO.press.
- When the email was published on 5 May 2023, the password still worked, nearly three years later, and it was changed only hours afterwards.
- The account held materials for public sector clients, including a detailed plan of the Gdynia naval port, military map overlays and a Warsaw flood evacuation plan.
- The identity lesson: shared account credentials that are emailed and never rotated become permanent keys for anyone who ever reads that email.
At a glance
| Organisations | Esri Polska (ArcGIS); Poland's Government Centre for Security (RCB) and other public sector clients |
|---|---|
| When | Credentials emailed July 2020; email published and credentials found valid on 5 May 2023; password changed hours later |
| Attacker | The Poufna Rozmowa channel, publishing mail stolen from Polish officials; OKO.press says findings point to Belarusian and Russian services (reported links to UNC1151, also known as Ghostwriter) |
| Entry point | A plain-text login and password in an email that was later stolen from a minister's private mailbox and published |
| Identities abused | A shared ArcGIS account login used to share materials with public sector clients |
| Impact | Sensitive geospatial materials, including military and critical infrastructure maps, reachable by anyone who read the published email until the password was changed; no confirmed misuse beyond journalists and others checking the login |
| Category | NHI. Incident class: exposure (shared credential public, no confirmed misuse) |
What happened
According to OKO.press, in July 2020 Bogdan Z., then a director at Esri Polska, emailed a link to a presentation hosted on ArcGIS, analysing data for an example crisis situation. In the same message, without encryption, he included the login and password for the ArcGIS account. The email went to Grzegorz Matyasik, deputy director of the Government Centre for Security, and to Hubert Królikowski, then director of the defence analysis department in the Prime Minister's Chancellery. Matyasik forwarded it to Michał Dworczyk's private email account, adding which browser to use to open the link. "None of the people in the correspondence noticed that sending unprotected access data broke a basic rule of digital security," OKO.press wrote (translated).
Dworczyk's private mailbox was among several hacked accounts whose contents Poufna Rozmowa has published since 2021. On Friday 5 May 2023 it published this email. Internet users immediately tried the login, and it worked. A Newsweek journalist, Dariusz Ćwiklak, and an OKO.press informant logged in and saw the materials. OKO.press reported that the password was changed only a few hours after publication.
The account appears to have opened folders belonging to Esri Polska's public sector clients. A client list visible there named the Government Centre for Security, the national police headquarters, the Border Guard, the Polish Army's geospatial reconnaissance command, the special forces component command, the military intelligence service and the Central Anti-Corruption Bureau. Materials included a very detailed plan of the Gdynia naval port with building functions and security zones, maps with military overlays, a power network diagram for the Gdańsk ship repair yard, a map of railway stations and an analysis of flooding in Warsaw with an evacuation plan. Digital Watch Observatory and iHLS, citing OKO.press, noted that the account owners appear to have been unaware for three years that the credentials were compromised.
Timeline
| Date | Event |
|---|---|
| July 2020 | An Esri Polska manager emails an ArcGIS link, login and password to officials; the email is forwarded to minister Dworczyk's private mailbox. |
| 2021 | Poufna Rozmowa starts publishing emails stolen from Dworczyk and other officials. |
| 5 May 2023 | The ArcGIS email is published; the credentials still work; OKO.press reports the exposure the same day and the password is changed hours after publication. |
| 12 May 2023 | International outlets, including Digital Watch Observatory, report OKO.press's findings. |
How it happened: the identity attack path
- Credentials sent in plain text. A shared ArcGIS login and password were emailed together with the link they protected.
- Forwarded to a private mailbox. The email was forwarded to a minister's private account outside government controls.
- Mailbox compromised. That mailbox was hacked, and its contents were published over time by Poufna Rozmowa.
- Never rotated. The password was not changed for nearly three years, so it still worked when published.
- Public access. Anyone reading the post could log in and view sensitive client folders until the password was changed.
Impact
- Exposed: geospatial materials for public sector and security clients, including a naval port plan, military map overlays, infrastructure diagrams and an evacuation plan.
- Confirmed access: journalists and others logged in after publication to verify the credentials.
- Unknown: whether the hackers who stole the mailbox used the credentials before publication.
What this means for NHI governance
The credential here was not one person's login but a shared account used to give clients access to materials. Shared accounts behave like non-human identities: nobody owns them personally, they are handed around, and they rarely get rotated because changing them would break everyone's access. Sending the password in the same email as the link meant the email itself became the key, and it kept working for as long as the email existed.
The fix is to stop sharing credentials at all. Individual accounts with MFA, or time-limited sharing links, give each recipient their own access that can be revoked. Where a shared credential cannot be avoided, it belongs in a vault with an owner and a rotation schedule. See our Public Sector Identity Security Guide and Secrets Management Guide.
Recommendations
- Never send passwords by email. Especially not in the same message as the link or username they go with. See the Password Security Guide.
- Replace shared accounts with individual access. Give each client or user their own identity with MFA, or use expiring share links.
- Rotate shared credentials on a schedule. Any credential that must be shared needs an owner, a vault and regular rotation. See our Secrets Management Guide.
- Keep official business off private mailboxes. Forwarding sensitive material to private accounts moves it outside security controls. See the Public Sector Identity Security Guide.
- Assume credentials in stolen mail are compromised. After a mailbox breach, search it for credentials and rotate them before the attacker publishes. See the Leaked Credential Response Playbook.
Frequently asked questions
What was leaked in the Polish military ArcGIS incident?
A July 2020 email containing a link, login and password for an ArcGIS account was published on 5 May 2023. The account held maps and analyses for public sector clients, including a detailed plan of the Gdynia naval port, military map overlays and a Warsaw flood evacuation plan.
Why did a three-year-old password still work?
The shared account's password had not been changed since the email was sent in 2020. It was changed only a few hours after the email was published, according to OKO.press.
Who published the email?
The Telegram channel Poufna Rozmowa, which has published mail stolen from Polish officials since 2021. OKO.press says findings point to Belarusian and Russian services behind the mailbox hacks.
Related NHI Mgmt Group resources
United Nations Breach 2021 · Indian Government Breach 2021 · Public Sector Identity Security Guide · Password Security Guide · Leaked Credential Response Playbook
How NHI Mgmt Group can help
Shared accounts and emailed credentials are some of the hardest identities to track. We help public and private sector teams find shared credentials, replace them with individual or managed access and put owners and rotation in place. See our NHI and AI agent security training.