The Swedish Data Protection Authority (IMY) issued an administrative fine of SEK 1,800,000 (≈ EUR 160,000) to IT service provider Miljödata after a cyberattack exposed personal and sensitive data of 2.2 million individuals. The authority found Miljödata failed to implement adequate technical and organisational safeguards, including software installation checks and real‑time intrusion monitoring. The decision was dated 22/09/2026.
Why it matters: The fine highlights enforcement of GDPR Article 32 security obligations for processors handling large volumes of personal data.
Summary generated from the sources below. Check the primary source before relying on it; this is not legal advice.
