Sweden’s data protection authority, IMY, has fined software supplier Miljödata about €160,000 over a data breach that exposed personal information belonging to more than 2.2 million people. The penalty was issued on September 22, 2026, and IMY found the company violated GDPR Article 32(1). The decision matters well beyond one company because Miljödata’s software sits behind a large share of Sweden’s public sector.
In Swedish currency, the fine comes to SEK 1.8 million. The regulator’s case centers on two failures. Miljödata had not properly checked newly installed software before putting it into production, and it lacked automated, real-time monitoring that could flag intrusions as they happened.
More decisions may follow. IMY has also opened investigations into the city of Gothenburg, the Region of Västmanland and Älmhult municipality in connection with the attack, and said additional penalties could follow once those inquiries conclude.
What IMY Found
Two gaps at the heart of the decision
IMY did not fine Miljödata simply because it was attacked. The authority’s finding was that the company’s safeguards did not match the sensitivity of the data it handled. IMY concluded the company failed to maintain a sufficiently high level of technical and organizational security for the kinds of personal data it processed, and judged it negligent.
A vulnerable component left in place
According to reporting on the decision, the entry point was a piece of third-party security software. IMY said Miljödata failed to properly vet a vulnerable firewall component, which led to the ransomware attack. That outdated component reportedly sat inside Miljödata’s environment for roughly a week before attackers used it, and its vulnerabilities were already listed on the supplier’s own website.
Who Was Affected and What Leaked
Miljödata supplies HR and work environment systems to municipalities, regions, government agencies and private employers. Its software is used across about 80% of Sweden’s municipal systems. That reach explains why one intrusion touched so many people, roughly a fifth of Sweden’s population.
The stolen records went far beyond names and email addresses. They included Swedish personal identity numbers, contact details, sick leave information, rehabilitation files and records of incidents in schools. Some of the school incident records involved minors.
The ransom demand and the leak
The attacker demanded 1.5 Bitcoin and, when the ransom went unpaid, published the stolen data on the dark web under the name Datacarry. Who was actually behind the attack remains unknown. A police investigation into gross data intrusion and attempted gross extortion was conducted but closed for lack of evidence.
| Date | Development |
|---|---|
| August 25, 2025 | Cyberattack hits Miljödata, disrupting services for public sector customers |
| After the attack | Ransom of 1.5 Bitcoin demanded; data later published on the dark web |
| Later | Police investigation closed for lack of evidence |
| September 22, 2026 | IMY fines Miljödata SEK 1.8 million under GDPR Article 32(1) |
| Ongoing | IMY investigations into Gothenburg, Region Västmanland and Älmhult |
Why a Vendor Fine Matters for Sweden’s Public Sector
Most GDPR enforcement lands on the organization that owns the data. Here, IMY went after the supplier directly. Commentators have noted that while the penalty is modest at roughly SEK 0.82 per affected person, it establishes that a processor can be fined directly for security failures that hit its public sector clients.
That does not let customers off the hook. The open investigations into Gothenburg, Västmanland and Älmhult suggest IMY is also examining how public bodies chose and oversaw the vendor holding their employees’ and residents’ data.
Background: what GDPR Article 32 requires
Article 32 obliges both controllers and processors to put in place security measures appropriate to the risk of the data they handle, taking into account factors such as the state of the art and the nature of the processing. Violations of Article 32 fall under the GDPR’s lower fine tier, which allows penalties of up to €10 million or 2% of worldwide annual turnover, whichever is higher. Health-related information like sick leave and rehabilitation records is treated as a special category of data, which raises the level of protection regulators expect.
What Happens Next
Miljödata is not accepting the ruling quietly. The company has said on its website that it does not agree with all of IMY’s conclusions, and it can appeal the fine to an administrative court within three weeks.
For the 2.2 million people affected, the data breach cannot be undone, since the records are already public. The practical fallout will likely come from the pending municipal and regional decisions, which could shape how Swedish public bodies vet suppliers from here on.
