Østre Toten municipality – €412,000 Fine (Norway, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
Østre Toten municipality in Norway faced a significant fine after a cyberattack exposed sensitive personal data. The attack revealed weaknesses in their data security practices, including the lack of two-factor authentication. This case serves as a reminder for organizations to strengthen their cybersecurity measures.
What happened
A cyberattack on Østre Toten municipality led to the exposure and publication of sensitive personal data on the dark web.
Who was affected
Residents and employees of Østre Toten municipality whose sensitive personal data was compromised.
What the authority found
The Norwegian DPA fined Østre Toten municipality for inadequate data security measures, violating GDPR's security obligations.
Why this matters
This incident highlights the importance of implementing strong security measures, such as two-factor authentication and secure backups, to protect personal data. Organizations should regularly assess and improve their cybersecurity practices to prevent similar breaches.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
National Law Articles
The Norwegian DPA has fined Østre Toten municipality EUR 412,000. The municipality suffered a cyberattack in January 2021, as a result of which the municipality's data was encrypted as well as backups were deleted. A larger amount of data was later published on the dark web. Approximately 30,000 documents were affected by the attack. The documents contained, among other things, information on ethnic origin, political opinion, religious beliefs, union memberships, sexual orientation, health status, as well as banking data of the municipality's residents and employees. The DPA's investigation revealed that the municipality had fundamental deficiencies in the security of personal data and related internal controls.Among other things, the municipality had not used two-factor authentication when logging into systems, and lacked appropriate backup systems.
Related Enforcement Actions (2)
Other enforcement actions involving Østre Toten municipality in NO
Fine
€412K
Details
Fine Date
18 October 2021
Authority
Datatilsynet (Norway)
Fine Amount
€412,000
Enforcement Tracker ID
ETid-878
About this data
Cite as: Cookie Fines. Østre Toten municipality - Norway (2021). Retrieved from cookiefines.eu
Last updated: