Sweden fines Miljödata $183,000 over breach affecting 2.2 million
Sweden's IMY fined IT provider Miljödata $183,000 under GDPR for security failures behind an August 2025 breach affecting 2.2 million people.
Sweden's data protection authority IMY imposed a SEK 1.8 million ($183,000) fine on IT systems provider Miljödata for inadequate security leading to an August 2025 breach affecting 2.2 million people. The attacker demanded 1.5 Bitcoin (about $168,000) and leaked stolen data on the dark web as 'Datacarry', including personal identity numbers, sickness absence records, rehabilitation data, and school incidents involving minors. IMY found violations of GDPR Article 32(1), citing insufficient checks of newly installed software and no automated real-time intrusion monitoring. Investigations into two municipalities and one region are ongoing, with possible additional penalties.
- $183,000 (SEK 1.8M) GDPR fine for Article 32(1) security failures
- Breach affected 2.2 million people; data leaked under name 'Datacarry'
- Miljödata supplies work environment and HR systems to 80% of Swedish municipalities
- Further penalties possible as municipality investigations continue
- Countries
- SwedenEuropean Union
From the original article
2 min read at bleepingcomputer.com
Sweden's data privacy regulator, IMY, has imposed a $183,000 (SEK 1. 8 million) fine on IT systems provider Miljödata for inadequate security measures leading to a breach in August 2025 affecting 2. 2 million people.
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.