Swedish DPA fines Miljödata i Karlskrona approximately EUR 160 000 for insufficient technical and organisational measures to ensure information security
Swedish DPA fines Miljödata EUR 160K for insufficient security measures after 2.2M-person breach
Sweden's Data Protection Authority (IMY) has fined IT service provider Miljödata i Karlskrona approximately EUR 160,000 (SEK 1.8M) for violating GDPR Article 32 following a cyberattack in August 2025. The attack compromised personal data of 2.2 million individuals, including employees of Swedish municipalities, regions, government agencies, and private companies. The DPA found that Miljödata failed to maintain adequate technical and organizational security measures, including insufficient software installation checks and lack of real-time automated monitoring to detect intrusions.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Miljödata i Karlskrona?
Get an email when a new story names Miljödata i Karlskrona, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonMiljödata i Karlskrona, an IT service provider handling data for Swedish municipalities and government agencies, was fined €160,000 after a cyberattack compromised the personal data of 2.2 million individuals. The Swedish DPA found the company violated GDPR Article 32 by failing to implement adequate technical and organisational security measures, specifically lacking proper software installation controls and real-time automated intrusion detection. This case highlights the outsized risk that IT service providers represent — a single vendor's security failures can cascade across hundreds of public-sector clients. It also reinforces that GDPR compliance is not a checkbox exercise; regulators expect demonstrable, continuously maintained technical controls proportionate to the sensitivity and scale of data processed.
What helps against this
How we list vendors- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Security monitoring (SIEM)
Logs from everywhere end up in one place, with alerts that someone actually sees.