Miljödata i Karlskrona Aktiebolag – €158,400 Fine (Sweden, 2026)

An IT company that provides digital HR and occupational health services (Miljödata) detected a data breach in August 2025. In the breach, an external attacker had gained unauthorised access to the personal data of approximately 2,200,000 individuals (the data subjects) by a ransomware attack, extracted this data from the systems, and published it on the dark web. Miljödata isolated all its servers and activated an external incident response team on the evening it detected the breach. Miljödata reported the personal data breach to the DPA six days after it had happened. The attacker had gained access to the compromised data by performing a so-called SQL injection against a support component of a firewall solution that Miljödata had installed on a server in its technical environment. A limited number of children were among the data subjects affected. The data leaked included personal identification numbers, names, phone numbers, home addresses, email addresses, employment data, and sick leave information. The DPA investigated whether Miljödata had implemented appropriate technical and organisational measures to ensure a level of security appropriate to the risk as required by Article 32(1) GDPR. The DPA held that Miljödata had violated Article 32(1) GDPR by failing to implement appropriate technical and organisational measures and issued the company a fine of SEK 1,800,000 (€160,000). First, the DPA found that Miljödata had primarily acted as a processor and to a limited extent as a controller regarding the leaked data in its systems. As the obligation to implement appropriate technical and organisational measures in Article 32(1) GDPR applies to both controllers and processors, the DPA did not assess Miljödata's role concerning each processing activity in detail. Second, the DPA held that Miljödata had violated Article 32(1) GDPR. It considered the processing operations to pose high risks to the rights and freedoms of the data subjects. The processing was extensive – Miljödata had over 300 customers throughout Sweden, among them municipalities, regions, and other public entities. Moreover, the digital services Miljödata offered its customers involved extensive processing of sensitive personal data related to health, such as information on sick leave, data in rehabilitation documents, and information in medical certificates. The attacker had been present in Miljödata's technical environment for three days and gained access to additional information before the company's monitoring system had finally triggered an alert. The DPA concluded that the technical and organisational measures implemented by Miljödata had not met the high level of security required for the processing at issue. The support component that enabled the breach contained a critical vulnerability, was new, and had not undergone testing before being integrated in Miljödata's firewall system. When issuing the fine, the DPA held that Miljödata had acted negligently and considered the violation of Article 32(1) GDPR to have been of a serious nature. It took into account that the processing had been extensive and that the GDPR violation concerned Miljödata’s core business, where the company could be presumed to be well-positioned to implement appropriate security measures.