Edition

This is a permanent edition. It carries the briefing exactly as published on this date and does not change.

Swedish DPA fines Miljödata i Karlskrona EUR 160,000 for insufficient security measures after cyberattack

The Swedish Data Protection Authority (the Swedish DPA) on 22 September 2026 imposed an administrative fine of SEK 1,800,000 (approximately EUR 160,000) on IT service provider Miljödata i Karlskrona for insufficient technical and organisational security measures. This decision followed a cyberattack in August 2025 that compromised personal data of 2.2 million individuals, including sensitive information related to sick leave and student incidents.

The the Swedish DPA determined that Miljödata acted negligently by not maintaining a sufficiently high level of technical and organisational security, particularly given the types of personal data it processed. The investigation revealed that the company failed to conduct adequate checks when installing new software, a critical lapse in its security posture. Furthermore, Miljödata did not have automated real time monitoring of its systems to detect intrusions or suspicious activity, which would have been essential for prompt detection of suspicious activity. The compromised data included personal identity numbers, contact details, and sensitive data concerning sick leave, rehabilitation, and student related incidents in schools. The the Swedish DPA assessed the negligence as a violation of Article 32(1) of the GDPR, leading to the administrative fine.

Organisations processing large volumes of personal data, especially sensitive categories, consistently face scrutiny regarding their security measures, as evidenced by the Swedish DPA's fine against Miljödata.

The Swedish DPA administrative fine decision

Who this binds
All organisations processing personal data within the EU are legally bound by Article 32(1) of the GDPR to implement appropriate technical and organisational measures.
What changed
The the Swedish DPA decision confirmed that failing to conduct adequate software checks and lacking automated real time monitoring constitutes a violation of Article 32(1) GDPR.
What to watch
Organisations should review their security protocols for new software installations and consider implementing automated real time monitoring to detect intrusions, as these were specific failings identified by the Swedish DPA.
What this does not mean
This decision does not mean that every cyberattack automatically results in a fine; rather, it highlights the specific security measure deficiencies that led to the Swedish DPA's enforcement action.

Send this to your team

The Swedish Data Protection Authority fined Miljödata i Karlskrona approximately EUR 160,000 for insufficient technical and organisational security measures, specifically citing failures in new software checks and real time system monitoring, which applies to all organisations processing personal data.

Today's question

An IT service provider, Miljödata i Karlskrona, was fined by the Swedish DPA for insufficient technical and organisational security measures following a cyberattack. The investigation revealed that the company failed to conduct adequate checks when installing new software and lacked automated real time monitoring of its systems. Which of the following was a direct consequence of these security failures?

  1. A fine of EUR 160,000 for violating Article 32(1) GDPR.
  2. A requirement to implement a new data protection officer.
  3. A mandatory audit by an independent security firm.
  4. A public apology issued to all affected individuals.

Answer this question on the site

Worth knowing

  1. Australian OAIC publishes new resources on transparency for AI and automated decision making

    Australian APP entities must review and update their privacy policies by 10 December 2026 to comply with new transparency obligations regarding the use of AI and automated decision making that significantly impacts individuals, as outlined by the OAIC's new resources.

  2. Italian Garante Guidelines on Tracking Pixels in Emails are Effective October 29

    Organisations conducting email marketing in the EU must review their practices for using tracking pixels to ensure compliance with the Italian Garante's new guidelines.

  3. Laboratory Services Cooperative Agrees to Pay $6.1 Million to Settle Data Breach Litigation

    Healthcare providers in the US should note this significant settlement amount as a clear indicator of the financial risks associated with inadequate data security measures and subsequent data breaches under HIPAA.

Compiled that morning from regulator, court and authority sources. Primary sources are linked on every story.