Østre Toten municipality – €348,000 Fine (Norway, 2021)

In early 2021, a Norwegian municipality (Østre Toten kommune) realized they had been exposed to a serious ransomware attack that locked employees out of key IT systems. Data had been encrypted and backups deleted. About 30,000 documents were affected by the breach, including information about ethnic origin, political opinion, religious belief, trade union membership, sex life/sexual orientation, health, pedagogical diagnosis, birth number, electronic ID and bank account. About 2,000 documents were later discovered up for sale on the dark web. In total, about 160 GB of data was extracted and a large amount of data was irreparably lost. The technical investigation revealed that the municipality had severe deficiencies in their IT systems and processes, including unsecured back-ups and the lack of two-factor authentication and proper log management. The criminals had likely gained access to the infrastructure through remote access solutions, combined with stolen login credentials which were likely obtained through phishing scams directed at the municipality's employees (about ten email addresses and passwords belonging to employees were discovered during the investigation). The municipality notified the DPA about the breach and kept their inhabitants continuously informed. They also initiated a comprehensive work to establish routines for processing personal data and for data breach management. The Norwegian DPA found that the municipality had neither protected personal data sufficiently, nor had proper internal controls in place, in breach of Articles 5(1)(f), 24 and 32, cf. the [https://lovdata.no/dokument/NL/lov/2018-06-15-38 Personal Data Act § 26(1)]. For this, the Norwegian DPA fined the municipality €409,768 (NOK 4,000,000). In addition, the DPA instructed the municipality to establish and implement an appropriate information security management system, and to conduct (and document) risk assessments for all key systems in their infrastructure with the aim of identifying the need for risk-reducing measures.