Swedish DPA Fines IT Provider €160K After Cyberattack Exposes 2.2 Million Records

Miljödata i Karlskrona, an IT service provider handling data for Swedish municipalities and government agencies, was fined €160,000 after a cyberattack compromised the personal data of 2.2 million individuals. The Swedish DPA found the company violated GDPR Article 32 by failing to implement adequate technical and organisational security measures, specifically lacking proper software installation controls and real-time automated intrusion detection. This case highlights the outsized risk that IT service providers represent — a single vendor's security failures can cascade across hundreds of public-sector clients. It also reinforces that GDPR compliance is not a checkbox exercise; regulators expect demonstrable, continuously maintained technical controls proportionate to the sensitivity and scale of data processed.

Tactical Insight

Immediate actions

Audit all software installation processes and enforce an approved application allowlist to prevent unauthorised software from being deployed.
Deploy real-time intrusion detection and SIEM tooling to generate automated alerts for anomalous activity across all environments handling personal data.

Long-term improvements

Establish a formal vendor security assurance programme that requires IT service providers to evidence GDPR Article 32 compliance at contract signing and annually thereafter.
Conduct regular Data Protection Impact Assessments (DPIAs) when processing personal data at scale, particularly where multiple public-sector clients are involved.
Implement a configuration management baseline and enforce it through automated compliance scanning to detect drift from approved secure states.

Detection & response measures

Define and test an incident response plan specifically covering large-scale data breaches, including 72-hour GDPR notification workflows to the relevant DPA.
Establish continuous monitoring dashboards with defined thresholds that escalate to on-call security personnel without requiring manual review.

Framework References

GDPR Article 32 – Security of processingGDPR Article 33 – Notification of a personal data breach to the supervisory authorityNIST CSF DE.CM-1 – Network monitoring to detect potential cybersecurity eventsNIST SP 800-53 SI-3 – Malicious Code ProtectionNIST SP 800-53 SI-4 – Information System MonitoringNIST SP 800-53 CM-7 – Least Functionality (software restriction)CIS Control 4 – Secure Configuration of Enterprise Assets and SoftwareCIS Control 8 – Audit Log ManagementCIS Control 10 – Malware DefensesCIS Control 13 – Network Monitoring and DefenseISO/IEC 27001:2022 Annex A 8.8 – Management of technical vulnerabilitiesISO/IEC 27001:2022 Annex A 8.16 – Monitoring activities

Source

ThreatNoir coverageSwedish DPA fines Miljödata i Karlskrona approximately EUR 160 000 for insufficient technical and organisational measures to ensure information security Read originalSwedish DPA fines Miljödata i Karlskrona approximately EUR 160 000 for insufficient technical and organisational measures to ensure information security

PublishedOct 08, 2026