Swedish DPA fines Miljödata i Karlskrona approximately EUR 160 000 for insufficient technical and organisational measures to ensure information security

What happened

In August 2025 Miljödata i Karlskrona suffered a cyberattack that compromised personal data of 2.2 million individuals, including identity numbers and health information. The breach affected Swedish municipalities, regions, government agencies and private firms. The Swedish Data Protection Authority (IMY) found Miljödata lacked adequate technical and organisational safeguards under Article 32(1) GDPR and imposed an administrative fine of SEK 1 800 000 (≈€160 000).

Why it matters

Data processors handling large volumes of sensitive personal data must upgrade security controls, especially real‑time intrusion monitoring and software change management, to avoid similar penalties.

Business impact

Organizations that process comparable data sets may face increased scrutiny and fines if they do not implement robust monitoring and change‑control procedures.

Checklist

• Implement real‑time intrusion detectionHigh priority

  Deploy automated monitoring tools to alert on suspicious activity across all systems.

• Strengthen software change controlsHigh priority

  Require security reviews and testing before installing or updating any software.

• Conduct GDPR Article 32 auditMedium priority

  Assess technical and organisational measures against the risk profile of processed data.

Who reported it

Discussion