[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fh3RvevalDhfiS_1dJ3MVTz8apQGrOMn1ob1Qo1UqD30":3},{"article":4,"iocs":46,"watch_terms":51,"solutions":52,"lesson":142},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"ff38ba90-1ff3-43fd-a7f5-4b11e219a68c","IMY (Sweden) - IMY-2025-21177","imy-sweden-imy-2025-21177-26b5cb","← Older revision Revision as of 06:41, 30 September 2026 Line 84: Line 84: }} }} The DPA fined an IT company SEK 1,800,000 (€160,000) for a failure to implement appropriate technical and organisational measures following a data breach affecting over 2 million individuals. The DPA fined an IT company providing digital HR and occupational health services SEK 1,800,000 (€160,000) for a failure to implement appropriate technical and organisational measures following a data breach affecting over 2 million individuals. == English Summary == == English Summary ==","Sweden's IMY fined Miljödata i Karlskrona Aktiebolag SEK 1,800,000 (€160,000) for violating GDPR Article 32(1) by failing to implement appropriate technical and organizational security measures. A ransomware attack in August 2025 exploited a SQL injection vulnerability in a firewall support component, allowing attackers to breach data of approximately 2.2 million individuals including personal identification numbers, names, addresses, and employment data. The company detected the breach and engaged incident response, but the DPA found the security posture inadequate for the high-risk processing of data across 300+ Swedish customers including municipalities and public entities.","Swedish DPA fines IT company €160k for inadequate security measures enabling 2.2M-person breach.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=IMY_(Sweden)_-_IMY-2025-21177&diff=53227&oldid=53203","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fthumb\u002F7\u002F75\u002FLogoSE.png\u002F1200px-LogoSE.png","2026-09-30T06:41:29+00:00","2026-09-30T08:00:16.224213+00:00",8,[17,20,22],{"name":18,"type":19},"Miljödata i Karlskrona Aktiebolag","vendor",{"name":21,"type":19},"IMY (Swedish Data Protection Authority)",{"name":23,"type":24},"SQL injection","technology","3f0f8451-91df-4b6c-9a73-ef3b2509b7f1",{"id":25,"icon":27,"name":28,"slug":29},null,"GDPR","gdpr",[31,36,41],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":37},{"id":38,"icon":27,"name":39,"slug":40},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":42},{"id":43,"icon":27,"name":44,"slug":45},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[47],{"type":48,"value":49,"context":50},"malware","ransomware","SQL injection attack exploiting firewall support component to enable data exfiltration",[18,21],{"controls":53,"vendors":141},[54,83,112],{"slug":55,"name":56,"problem":57,"products":58},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[59,67,75],{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":84,"name":85,"problem":86,"products":87},"patch-management","Automated patch management","Known holes get closed in days, not months.",[88,96,104],{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":113,"name":114,"problem":115,"products":116},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[117,125,133],{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",[],{"slug":143,"title":144,"body":145,"framework_refs":146,"framework_notes":158},"sql-injection-in-firewall-component-exposes-22-million-swedes-earns-160k-gdpr-fine","SQL Injection in Firewall Component Exposes 2.2 Million Swedes, Earns €160K GDPR Fine","Miljödata i Karlskrona failed to implement adequate security controls required under GDPR Article 32(1), despite processing highly sensitive personal data — including national identification numbers — on behalf of over 300 public-sector customers. A known SQL injection vulnerability in a firewall support component was left unmitigated, providing attackers a direct path to deploy ransomware and exfiltrate records belonging to approximately 2.2 million individuals. This case illustrates that organizations acting as data processors for municipalities and public entities carry elevated accountability: the sensitivity and scale of the data processed demands a proportionally rigorous security posture. The fine underscores that detecting a breach and engaging incident response after the fact does not satisfy the proactive obligation to prevent foreseeable attacks through timely patching and hardening.",[147,148,149,150,151,152,153,154,155,156,157],"GDPR Article 32(1) — Appropriate technical and organisational measures","GDPR Article 32(2) — Risk-proportionate security assessment","CIS Control 7 — Continuous Vulnerability Management","CIS Control 12 — Network Infrastructure Management","CIS Control 16 — Application Software Security","NIST SP 800-53 SI-2 — Flaw Remediation","NIST SP 800-53 SA-11 — Developer Testing and Evaluation","NIST SP 800-53 RA-5 — Vulnerability Monitoring and Scanning","NIST Cybersecurity Framework — ID.RA (Risk Assessment), PR.IP (Information Protection Processes)","ISO\u002FIEC 27001:2022 — A.8.8 Management of technical vulnerabilities","OWASP Top 10 — A03:2021 Injection",{}]