- Enforcing jurisdiction
- Norway · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Østre Toten municipality – €412,000 Fine (Norway, 2021)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
Østre Toten municipality was fined €412,000 after a cyberattack exposed sensitive data of around 30,000 documents. The attack revealed serious weaknesses in the municipality's data security measures. This case highlights the critical need for strong cybersecurity practices.
What happened
The municipality suffered a cyberattack that encrypted data and deleted backups, leading to sensitive information being published online.
Who was affected
Residents and employees of Østre Toten municipality whose personal information was compromised in the attack.
What the authority found
The Norwegian Data Protection Authority found that the municipality lacked adequate security measures to protect personal data.
Why this matters
This case serves as a warning for public entities to strengthen their cybersecurity defenses. Local governments should prioritize data security to protect citizens' information.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 6 March 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Norwegian DPA has fined Østre Toten municipality EUR 412,000. The municipality suffered a cyberattack in January 2021, as a result of which the municipality's data was encrypted as well as backups were deleted. A larger amount of data was later published on the dark web. Approximately 30,000 documents were affected by the attack. The documents contained, among other things, information on ethnic origin, political opinion, religious beliefs, union memberships, sexual orientation, health status, as well as banking data of the municipality's residents and employees. The DPA's investigation revealed that the municipality had fundamental deficiencies in the security of personal data and related internal controls.Among other things, the municipality had not used two-factor authentication when logging into systems, and lacked appropriate backup systems.
Related Enforcement Actions (2)
Other enforcement actions involving Østre Toten municipality in NO
Fine
€412K
Details
Fine Date
18 October 2021
Authority
Datatilsynet (Norway)
Fine Amount
€412,000
Enforcement Tracker ID
ETid-878
About this data
Cite as: Cookie Fines. Østre Toten municipality - Norway (2021). Retrieved from cookiefines.eu
Last updated: