I'd recommend reading the the OCCRP investigation - https://www.occrp.org/en/investigation/european-password-man...