Swedish regulator fines IT provider Miljödata over data breach affecting millions

Sweden’s data protection authority, IMY, has fined IT systems provider Miljödata 1.8 million kronor, $183,000, for security failures that led to a 2025 cyberattack exposing the personal data of 2.2 million people.

Miljödata develops work-environment and human resources management systems used by roughly 80% of Sweden’s municipalities. In late August 2025, the company suffered a ransomware attack that disrupted IT services across Swedish municipalities and regions and compromised residents’ sensitive information. The attacker demanded 1.5 bitcoin, worth $168,000 at the time, to avoid leaking the stolen data, then published it on the dark web under the name "Datacarry." The exposed information included personal identity numbers, details, sickness-absence and rehabilitation records, and information related to school incidents involving minors.

IMY opened an investigation in November 2025 to determine whether security shortcomings violated Miljödata’s obligations under the European Union’s General Data Protection Regulation. The agency found that the company failed to adequately check newly installed software and lacked automated, real-time monitoring to detect intrusions and suspicious activity, concluding that Miljödata did not maintain a sufficiently high level of technical and organizational security given the type of personal data it processed. IMY said the failures violated Article 32(1) of the GDPR and imposed the penalty accordingly.

According to Miljödata, the breach traced to a firewall support component the company installed a week before the attack; the component was outdated and contained a long-known, critical vulnerability. Miljödata has said it had no reason to suspect the installed version, since it was an expensive product from a well-known supplier.

Eric Leijonram, IMY’s director general, said in a statement that Miljödata’s failures allowed a threat actor to obtain information on a large of Sweden’s population, calling the incident serious. He said he hopes other organizations take note of the sanction and review the security of the personal data they are responsible for.

Miljödata has said on its website that it does not agree with all of IMY’s conclusions and can appeal the fine to an administrative court within three weeks. A police investigation into gross data intrusion and attempted gross extortion related to the breach was conducted but was closed for lack of evidence.

IMY said it has also opened investigations into two municipalities and one region connected to the attack — the city of Gothenburg, the Region of Västmanland and Älmhult municipality — and that additional penalties could follow once those inquiries conclude.

Please take 30 seconds to register

Already have an account? Sign in

"If we think of usability and security as mutually exclusive - we have failed" - Jerrod Chong, Yubico

#teissLondon2018: On the internet, nobody knows you are a fridge

1 in 6 gamers disable all AV in the pursuit of the highest possible speeds

10 malicious Python Libraries discovered on PyPI Repository

126,000 affected by cyberattack on New Zealand patient portal Manage My Health

"If we think of usability and security as mutually exclusive - we have failed" - Jerrod Chong, Yubico

#teissLondon2018: On the internet, nobody knows you are a fridge

1 in 6 gamers disable all AV in the pursuit of the highest possible speeds

10 malicious Python Libraries discovered on PyPI Repository

126,000 affected by cyberattack on New Zealand patient portal Manage My Health

19-year-old claims he hacked into over 25 Tesla cars in 13 countries

2020 cybersecurity trends and resolutions

2025 in review: why cyber-security became a boardroom crisis

Closing the exposure window — unifying continuous threat exposure management

Trusting your AI agents

The blind spots in your stack - why fragmented data security fails

Winston House, 3rd Floor, Units 306-309, 2-4 Dollis park, London, N3 1HF