Sweden fines Miljödata $183,000 over breach affecting 2.2 million

By Bill Toulas

• September 22, 2026
• 05:40 PM
• 0

Sweden’s data privacy regulator, IMY, has imposed a $183,000 (SEK 1.8 million) fine on IT systems provider Miljödata for inadequate security measures leading to a breach in August 2025 affecting 2.2 million people.

Miljödata is a Swedish software company that develops and provides work environment and HR management systems used by 80% of Sweden’s municipal systems.

Last year, on August 25, the company suffered a cyberattack that disrupted IT services in over 200 regions and compromised residents' sensitive data.

The threat actor demanded a ransom of 1.5 Bitcoin (valued at $168,000 at the time) to prevent leaking the stolen information, but published it on the dark web under the name “Datacarry.”

The information included personal identity numbers, contact information, sickness absence, rehabilitation, and even school incidents involving underage individuals.

IMY launched an investigation in November 2025 to determine whether any security shortcomings violated the company’s obligations under the European Union’s General Data Protection Regulation (GDPR).

The agency has now confirmed that the company failed to adequately check newly installed software and lacked automated, real-time monitoring  mechanisms to detect intrusions and suspicious activity.

“IMY’s investigation shows that the company did not maintain a sufficiently high level of technical and organizational security, considering the types of personal data it processed,” reads the announcement.

“The company did not perform sufficient checks when installing new software and did not have automated real-time monitoring of its systems to detect intrusions and suspicious activity.”

The negligence constitutes a violation of Article 32(1) of the GDPR, for which the agency imposed a penalty of $183,000.

Threat actors sometimes use the prospect of regulatory penalties to pressure victims into paying, and may set demands below what they believe an incident would ultimately cost, to incentivize victims to pay the ransom.

IMY noted that it has also launched investigations into two municipalities and one region in connection with the attack on Miljödata, which are ongoing, so additional penalties may be imposed in the future.

.article-callout { background-color: #f0f6ff; width: 95%; max-width: 800px; margin: 15px auto; border-radius: 8px; border: 1px solid #d6ddee; display: flex; align-items: stretch; overflow: hidden; } .article-media { flex: 1; max-width: 220px; display: flex; } .article-media a { display: flex; width: 100%; height: 100%; } .article-media img { width: 100%; height: 100%; border-radius: 8px 0 0 8px; display: block; } .article-callout .article-media img { margin-top: 0 !important; height: 100% !important; } .article-body { flex: 2; padding: 10px; display: flex; flex-direction: column; justify-content: center; } .article-body h2 { font-size: 17px !important; font-weight: 700; color: #333; line-height: 1.4; font-family: Georgia, "Times New Roman", Times, serif; margin: 0 0 14px 0; } .article-body p { font-weight: bold; font-size: 14px; margin: 0 0 clamp(6px, 2vw, 14px) 0; } .article-link { background-color: #fff; border: 1px solid #3b59aa; color: black; text-align: center; text-decoration: none; border-radius: 8px; display: inline-block; font-size: 16px; font-weight: bold; padding: 10px 20px; width: fit-content; } @media (max-width: 600px) { .article-callout { flex-direction: column; align-items: center; } .article-media { max-width: 100%; } .article-media img { border-radius: 8px 8px 0 0; } .article-body { padding: 15px; width: 100%; } .article-link { width: 100%; margin: 0 auto; box-sizing: border-box; } }

Build your security blueprint for AI-powered attacks

Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.

Save your seat

Related Articles:

French hospital fined €500,000 after breach exposes data of 727,000

Google fined €403 million over location data privacy violations

Japan's Digital Agency says VPN flaw exposed 246,000 personnel records

IDScan sued over alleged data breach affecting 153 million drivers

Berlin confirms data theft after Rhysida ransomware attack claims