Norwegian Authority Fines Microsoft $10 Million for Data Privacy Breach

www.datatilsynet.no

Norwegian Authority Fines Microsoft $10 Million for Data Privacy Breach

First seen 12 Oct 2026, 12:31 UTC • •27.0

Article Content

1 / 3

Browse articles

ThreatCluster •October 12, 2026 at 15:35 UTC

•Microsoft fined 92 million kroner for data breach involving Grindr users.
•Xandr shared sensitive data without proper user consent, affecting thousands.
•Norwegian authority emphasizes companies' responsibility for data protection.

The Norwegian Data Protection Authority has fined Microsoft 92 million kroner ($9.6 million) for unlawfully sharing sensitive data of thousands of users in Norway. The fine, the highest issued by the authority to date, stems from Microsoft's advertising service Xandr relaying personal data of Grindr users, including sexual orientation, to numerous other companies. The case was initiated by Norway's Consumer Protection Agency in 2020. Xandr claimed it believed Grindr had obtained user consent, but the Norwegian authority rejected this defense, emphasizing that companies must ensure lawful data processing. The breach highlights significant issues within the advertising ecosystem regarding user data protection.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated just now How this analysis works

Timeline

2020-01-01

Investigation initiated

Norway's Consumer Protection Agency opened a case against Microsoft regarding data sharing practices.

2026-10-12

Fine issued to Microsoft

The Norwegian Data Protection Authority fined Microsoft 92 million kroner for serious data breaches involving Grindr user data.

More articles in this cluster (2)

Threat Graph

4 entities, 3 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (1)

Data Breach

Organization (2)

Grindr
Microsoft

Affected Platform (1)

Xandr

Relationships

Data Breach targets Xandr
Data Breach related to Grindr
Data Breach related to Microsoft

Following this threat?

Track Grindr in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Common questions

What data was shared unlawfully?

Sensitive personal data of Grindr users in Norway, including sexual orientation, was shared without proper consent.

What was the response from Microsoft?

Xandr, a Microsoft advertising service, claimed it believed user consent was obtained, but this was rejected by the Norwegian authority.

How does this affect users?

Thousands of users in Norway may have had their sensitive data unlawfully shared, raising serious privacy concerns.

Continue Reading

CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active…

CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…