IMY (Sweden) - IMY-2025-21177
Swedish DPA fines IT company €160k for inadequate security measures enabling 2.2M-person breach.
Sweden's IMY fined Miljödata i Karlskrona Aktiebolag SEK 1,800,000 (€160,000) for violating GDPR Article 32(1) by failing to implement appropriate technical and organizational security measures. A ransomware attack in August 2025 exploited a SQL injection vulnerability in a firewall support component, allowing attackers to breach data of approximately 2.2 million individuals including personal identification numbers, names, addresses, and employment data. The company detected the breach and engaged incident response, but the DPA found the security posture inadequate for the high-risk processing of data across 300+ Swedish customers including municipalities and public entities.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Miljödata i Karlskrona Aktiebolag?
Get an email when a new story names Miljödata i Karlskrona Aktiebolag, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonMiljödata i Karlskrona failed to implement adequate security controls required under GDPR Article 32(1), despite processing highly sensitive personal data — including national identification numbers — on behalf of over 300 public-sector customers. A known SQL injection vulnerability in a firewall support component was left unmitigated, providing attackers a direct path to deploy ransomware and exfiltrate records belonging to approximately 2.2 million individuals. This case illustrates that organizations acting as data processors for municipalities and public entities carry elevated accountability: the sensitivity and scale of the data processed demands a proportionally rigorous security posture. The fine underscores that detecting a breach and engaging incident response after the fact does not satisfy the proactive obligation to prevent foreseeable attacks through timely patching and hardening.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — ransomware