US order to purge Acronis tied to years of scrutiny over Russian ties

A U.S. government order posted last week that jettisons Acronis products from federal civilian systems was years in the making and focused largely on the firm’s development ties in Russia, two sources familiar with the matter told Nextgov/FCW.

The Swiss cybersecurity firm had been under the microscope since the first Trump administration, where officials had scrutinized it under Foreign Ownership, Control or Influence guidelines — or FOCI — according to a former U.S. official with knowledge of the matter. 

On top of this, key areas of scrutiny included whether Russian developers remained involved in Acronis products’ codebases, and whether the company had adequately mitigated related supply chain risks, according to a former DHS official aware of the efforts.

Both former officials spoke on the condition of anonymity to communicate sensitive information about how Acronis has been examined across the Biden and Trump administrations. Neither said there was concrete evidence produced indicating Acronis offerings had backdoors communicating with Moscow.

The move highlights a contemporary case of bipartisan, multi-administration foreign ownership review, and it underscores how long it can take officials to firmly determine that products tethered to government systems pose a security threat before they are kicked out of the federal market.

FOCI reviews, in essence, are sweeping government checks on whether a foreign person or entity could influence a company in ways that create national security risks.

Under a Department of Homeland Security directive signed July 31 by Secretary Markwayne Mullin, federal civilian agencies have until January 27 of next year to completely eliminate all software from the Swiss-headquartered vendor. The directive followed a formal risk recommendation from the interagency Federal Acquisition Security Council, or FASC.

The final removal order was only publicly posted to the Federal Register this past week. Its existence was first reported by Politico. 

It’s not entirely unusual for foreign ownership assessments to cross between presidential administrations, though the long timeline underscores the sometimes sluggish pace of federal supply chain security reviews: nearly a decade in this case. The reviews can leave targeted firms in limbo and slow their business activity while vetting occurs.

“The FASC keeps very tight control because of the damage it can do to companies and others. They take their job very seriously,” said the former DHS official, who added that they wished the council sometimes would work faster, referring to the Acronis scrutiny taking years.

The former DHS official also said Acronis could potentially face costly challenges contesting the scrutiny and may be less able to push back than a much larger company facing similar oversight. Other federal contractors that use Acronis could soon also find themselves removing company products from their systems. 

But, unlike other recent initiatives, the move does not fully ban the company from operating in the American private sector. The U.S. government, for instance, banned federal agencies and contractors from using Russia-based Kaspersky products starting in 2017, but later expanded the restriction through federal acquisition rules and comprehensive commercial sales bans.

In recent years, Acronis products have been purchased for government use often through resellers rather than contracts awarded directly to the company, according to GovTribe, a federal market intelligence platform owned by Nextgov/FCW parent company GovExec. 

Various defense and civilian services have used its products, including the Defense Information Systems Agency, Drug Enforcement Administration and National Oceanic and Atmospheric Administration. Acronis was last awarded a federal contract in 2016.

Founded in Singapore in 2003 and currently headquartered in Schaffhausen, Switzerland, Acronis offers data protection, backup, secure file sharing and recovery solutions. 

The company historically relied heavily on engineering and R&D talent based in Moscow. To bypass strict Russian laws against foreign tech procurement, Acronis entered a licensing agreement with a legally distinct Russian entity called Acronis Infoprotection, which took the core Acronis codebase, modified it to meet Russian government encryption standards and resold the localized software to Kremlin ministries and state-owned enterprises. 

But after the 2022 invasion of Ukraine, Acronis suspended operations in Russia, condemned the war, and migrated tech talent to Bulgaria, Singapore and Israel. In 2025, Swedish private equity firm EQT also acquired a majority stake in Acronis, and co-founder Serg Bell stepped down from executive management, leaving current CEO Prakash Panjwani and Chairman Warren Adelman at the helm.

Despite these shifts, federal scrutiny remained, and it culminated in the first-ever order under the Federal Acquisition Supply Chain Security Act last July, barring Acronis from intelligence community networks. Subsequent bans by the General Services Administration and Department of Defense followed before last week’s DHS order was posted.

Bell’s ties to Russian military-scientific initiatives have previously come under scrutiny from U.S. intelligence officials.

An Acronis spokesperson did not say whether the company would challenge the DHS directive. 

“On May 15, 2025, EQT, a Sweden-based private investment firm acquired a majority controlling interest in the Acronis group companies,” the spokesperson said. “Over 75% of the shares are owned by western blue chip investors including CVC Capital Partners, Sprincoast Partners and BlackRock. EQT requested and received CFIUS approval to close the transaction,” added the spokesperson, referring to the Committee on Foreign Investment in the United States, which vets overseas transactions for national security risks.