In his master's thesis, Arnis Parshovs, a Latvian who studied cyber security in Estonia, has identified security vulnerabilities in public services websites that emerge when users log in with bank passwords.
Parshovs has posted a YouTube video where he demonstrates how personal data can be stolen, reported ETV.
In Estonia, users can log into e-services, such as the government's eesti.ee portal, using either a national ID card, or alternatively with passwords issued by local bank's for their own websites.
Parshovs said the second option should be dropped because of the security lapse.
The Banking Association has recommended that people use their ID cards to log in, until an improved version of the system is released sometime next year.