Swedish Data Protection Authority fines Miljödata €160,000 over inadequate security safeguards

What happened

• In August 2025 Miljödata i Karlskrona suffered a cyberattack that compromised personal data of 2.2 million individuals, including identity numbers and health information.
• The breach affected Swedish municipalities, regions, government agencies and private firms.
• The Swedish Data Protection Authority (IMY) found Miljödata lacked adequate technical and organisational safeguards under Article 32(1) GDPR and imposed an administrative fine of SEK 1 800 000 (≈€160 000).

Why it matters

Data processors handling large volumes of sensitive personal data must upgrade security controls, especially real‑time intrusion monitoring and software change management, to avoid similar penalties.

Business impact

Organizations that process comparable data sets may face increased scrutiny and fines if they do not implement robust monitoring and change‑control procedures.

What to check

1. 1

   Implement real‑time intrusion detectionHigh priority

   Deploy automated monitoring tools to alert on suspicious activity across all systems.

2. 2

   Strengthen software change controlsHigh priority

   Require security reviews and testing before installing or updating any software.

3. 3

   Conduct GDPR Article 32 auditMedium priority

   Assess technical and organisational measures against the risk profile of processed data.