Cybersecurity Policy Report, Tech Upgrade Failure Leads to Data Breach Fine for Finnish Bank, (Oct 29, 2025)
Finland’s Office of the Data Protection Ombudsman has imposed a penalty of 865,000 euros ($1 million) on Aktia Bank plc over violations of the European Union’s General Data Protection Regulation (GDPR) following a breach that affected approximately 350 people.
Aktia’s electronic identification system experienced an hour-long disruption in January 2023 due to a technical change that allowed some people who logged onto Aktia’s online banking system to see other people’s information, the ombudsman explained in a news release.
The data breach “affected services for government agencies, unemployment funds, insurance companies and healthcare providers” and extended to “services that contain information that is strongly private, such as information about health and financial status,” the ombudsman said.
The investigation into the cause of the breach revealed that Aktia “should have planned and implemented the technical change to the identification service more carefully and tested the operation of the service sufficiently after the change,” it said.
The ombudsman issued the administrative penalty because Aktia failed to comply with data protection legislation requirements for the secure processing of personal data but took into account the fact that Aktia was prepared to react quickly to the incident and that it took immediate action to remedy that situation.
The decision can still be appealed to the administrative court.
News: InternationalLegislation DataPrivacy DataSecurity DataBreach GDPR LitigationEnforcement