Cybersecurity Policy Report, Software Provider Fined in Sweden for Lax Security Measures, (Sep 22, 2026)
By Tony Foley
The Swedish Authority for Privacy Protection (IMY) announced today that it had fined software and IT service company Miljödata i Karlskrona AB 1.8 million kroner ($182,500) after an audit revealed that the company failed to adopt appropriate data security measures, leading to a major leak following a data breach.
IMY’s announcement said that in August 2025, Miljödata was exposed to a data breach when a threat actor obtained a large amount of personal data and published it on the dark web. The company reported that 2.2 million people were affected by the incident, in which national ID numbers, contact details, and sensitive personal data about sick leave, rehabilitation, and student events were exposed.
The agency’s review showed that Miljödata did not have a sufficiently high level of technical and organizational security. It did not make sufficient checks when installing new software and did not conduct automatic real-time monitoring of its systems to detect intrusions and suspicious activity. Accordingly, IMY determined that the company acted negligently in violation of article 32(1) of the European Union’s General Data Protection Regulation (GDPR).
"GDPR requires appropriate security measures for the personal data you handle. Here, environmental data has been breached and the result is that a threat actor came across information about a large part of Sweden's population,” said Eric Leijonram, IMY’s director general. “We take the incident seriously. My hope is that other businesses will also take note of the sanction decision and, if necessary, review the security of the personal data they themselves are responsible for."
IMY further noted that Miljödata's customers affected by the attack included a majority of Sweden's municipalities, several regions and government agencies, and a large number of private companies. The agency has initiated audits of two municipalities and a region linked to the intruder’s attack on environmental data, which are ongoing.
News: InternationalLegislation LitigationEnforcement DataSecurity DataBreach GDPR