Miljödata i Karlskrona Aktiebolag – €158,400 Fine (Sweden, 2026)

An IT company that provides digital HR and occupational health services (Miljödata) detected a data breach in August 2025. In the breach, an external attacker had gained unauthorised access to the personal data of approximately 2,200,000 individuals (the data subjects) by a ransomware attack, extracted this data from the systems, and published it on the dark web. Miljödata isolated all its servers and activated an external incident response team on the evening it detected the breach. Miljödata reported the personal data breach to the DPA six days after it had happened. The attacker had gained access to the compromised data by performing a so-called SQL injection against a support component of a firewall solution that Miljödata had installed on a server in its technical environment. A limited number of children were among the data subjects affected. The data leaked included personal identification numbers, names, phone numbers, home addresses, email addresses, employment data, and sick leave information. The DPA investigated whether Miljödata had implemented appropriate technical and organisational measures to ensure a level of security appropriate to the risk as required by Article 32(1) GDPR. The DPA held that Miljödata had violated Article 32(1) GDPR by failing to implement appropriate technical and organisational measures and issued the company a fine of SEK 1,800,000 (€160,000). First, the DPA found that Miljödata had primarily acted as a processor and to a limited extent as a controller regarding the leaked data in its systems. As the obligation to implement appropriate technical and organisational measures in Article 32(1) GDPR applies to both controllers and processors, the DPA did not assess Miljödata's role concerning each processing activity in detail. Second, the DPA held that Miljödata had violated Article 32(1) GDPR. It considered the processing operations to pose high risks to the rights and freedoms of the data subjects. The processing was extensive