AEPD (Spain) - PS-00020-2025
Spain's AEPD fines insurance broker €200K for ransomware breach and insufficient security.
Spain's AEPD has fined an insurance broker €200,000 following a ransomware attack that exposed the data of approximately 40,000 individuals. The agency found that the broker had insufficient security measures in place and failed to conduct a Data Protection Impact Assessment (DPIA), violating GDPR principles.
AI summary of the linked source. Not reviewed by an editor. How this works
Run AEPD?
Get an email when a new story names AEPD, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAn insurance broker suffered a ransomware attack that compromised the personal data of approximately 40,000 individuals, resulting in a €200,000 fine from Spain's data protection authority, the AEPD. The root cause was a combination of inadequate technical security controls and a failure to perform a mandatory Data Protection Impact Assessment (DPIA) before processing high-risk personal data. DPIAs are a critical GDPR requirement that force organisations to proactively identify and mitigate privacy risks — skipping this step left significant vulnerabilities undetected and unaddressed. This case underscores that GDPR compliance is not a paper exercise; regulators expect organisations handling sensitive data at scale to implement layered technical defences commensurate with the risk. Financial penalties and reputational damage are the direct consequence of treating data protection obligations as optional.
What helps against this
How we list vendors- Automated patch management
Known holes get closed in days, not months.
- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
- Immutable backup and recovery
Ransomware cannot delete or encrypt your way back.