TL;DR
On 22 September 2026 the Swedish data protection authority (IMY) fined Miljödata i Karlskrona AB SEK 1.8 million for breaching Article 32(1) GDPR. In August 2025 an attacker stole data and published it on the darknet; according to the company it concerned 2.2 million people: personal identity numbers, contact details, data on sick leave, rehabilitation and school incidents. Two failings were found: insufficient checks when installing new software and no automatic real-time monitoring to detect intrusions. The conduct was found negligent. Affected customers include most Swedish municipalities, several regions and state agencies: IMY has opened reviews of two municipalities and a region.
What happened
Miljödata supplies information systems used by public bodies and private companies. In August 2025 an attacker breached its systems, copied a large amount of personal data and published it on the darknet. The company itself estimated 2.2 million people affected: a sizeable share of Sweden's population. The data included particularly sensitive information such as sick leave, employees' rehabilitation and reports of incidents in schools.
The two failings found
- NO CONTROL OVER NEW SOFTWARE. The company did not sufficiently check what was installed on its systems: one of the most common ways an attacker gets in and stays.
- NO REAL-TIME ALERT. There was no automatic monitoring able to flag intrusions and suspicious activity as they happened.
- THE YARDSTICK IS THE TYPE OF DATA. IMY found the security inadequate for what the vendor processed: with health and school data on millions of people, the required level is higher.
- A FINE FOR NEGLIGENCE. The conduct was classified as negligent, and the breach is of Article 32(1), which binds controllers and processors alike.
The customers are under review too
The fine hits the vendor, but that is not the end of the story. IMY has opened reviews of two municipalities and a region that used Miljödata's systems. Whoever entrusts data to a vendor must choose one providing sufficient guarantees (Art. 28(1)) and check it over time: the contract does not transfer responsibility.
Why a «small» amount matters
Compared with the number of people affected, SEK 1.8 million may look modest. The value of the decision lies elsewhere: the authority names two specific measures whose absence is enough to breach Article 32. They are the same ones any DPO can ask a vendor about tomorrow morning, and the ones an authority will look at first after the next attack.
What it means for the DPO
Five questions for vendors
One: who can install software on the systems that process our data, and with what prior check? Two: is there automatic 24-hour intrusion monitoring, and who receives the alert? Three: does the Article 28 contract describe concrete measures or only «appropriate measures»? Four: within how many hours does the vendor tell us about a breach? Five: when did we last check, with evidence rather than statements? In DPO Workspace the newly rebuilt breach procedure compares vendors' contractual deadlines with the controller's 72 hours.
Looking for a workspace for your DPO work?
DPO Workspace is built by a certified DPO. 30-day free trial.
Start free
