Sweden Fines Miljödata $183K for Major Data Breach Affecting 2.2 Million

• •Miljödata fined $183,000 for a breach affecting 2.2 million people.
• •The breach involved sensitive data including health and education records.
• •IMY cited inadequate software checks and lack of real-time monitoring as key failures.

On September 23, 2026, Sweden's data protection authority, IMY, fined Miljödata 1.8 million kronor ($183,000) due to a data breach from August 2025 that exposed sensitive personal information of 2.2 million individuals. The breach, attributed to a ransomware attack, compromised data including sick leave records, rehabilitation case files, and school incident reports. Miljödata, which provides IT systems for about 80% of Sweden's municipalities, failed to adequately check newly installed software and lacked real-time monitoring for intrusions. The attacker demanded a ransom of 1.5 bitcoin, which was later published on the dark web. IMY's investigation revealed that the breach stemmed from an outdated firewall component with known vulnerabilities. Miljödata plans to appeal the fine, and further investigations into affected municipalities are ongoing.