IMY decision September 22, 2026; published October 8, 2026
Sweden Fines Miljodata SEK 1.8 Million Under GDPR Article 32 After Data on 2.2 Million People Was Exposed
Sweden's data protection authority, IMY, fined IT provider Miljodata i Karlskrona SEK 1,800,000, approximately EUR 160,000, on September 22 for violating Article 32(1) of the GDPR, the security of processing duty, with the decision published on October 8. The fine followed an August 2025 cyberattack in which an attacker exfiltrated and published on the darknet personal data of 2.2 million individuals across Sweden's municipalities, regions, agencies, and private companies, including personal identity numbers, contact details, and sensitive data on sick leave, rehabilitation, and school incidents. IMY found that Miljodata, a data processor for Swedish public-sector bodies, acted negligently: its security was not proportionate to the personal data it processed, it ran inadequate checks when installing new software, and it had no automated real-time monitoring to detect intrusions or suspicious activity. The fine was set under Article 83(4), which caps penalties at EUR 10 million or 2 percent of worldwide annual turnover.
Executives
A processor was fined not for being attacked, but for security that did not match the sensitivity of what it held. If vendors process bulk or sensitive personal data for you, their Article 32 posture is your exposure as well: ask for evidence of change verification and real-time monitoring, not assurances, and put the answers in the vendor file.
CIO / CISO
IMY named two concrete gaps, and both are testable in your own estate this week: what checks run when new software is installed or updated, and whether automated real-time monitoring would actually catch an intrusion in progress. Reassess your Article 32 measures against the volume and sensitivity of the data involved, because the authority held that the bar rises with bulk and special-category data.
Engineers
Close the named gaps with evidence: verified software change controls with recorded checks, intrusion monitoring that alerts in real time across systems holding personal data, and access management, logging, and network segregation reviewed for bulk data stores. Document the measures and their review cycle so the program can be shown to a supervisory authority on demand.
Everyone (non-IT)
Data about 2.2 million people in Sweden, including sick leave and school records, was published after an attack on one IT provider that served many public bodies. It is a reminder that your information often sits with companies you never chose, which is why regulators fine the provider when its protections fall short.