The Swedish Authority for Privacy Protection, IMY, has decided that Miljödata must pay an administrative fine of SEK 1.8 million after an extensive data breach in 2025. This is stated in a press release.
According to Miljödata, 2.2 million people were affected by the incident, in which personal data was later published on the Darknet. The data included personal identity numbers, contact details and sensitive information about, among other things, sick leave and rehabilitation.
IMY’s review shows deficiencies in the company’s technical and organizational security, including inadequate controls during the installation of new software and a lack of automatic real-time monitoring. The authority assesses that Miljödata acted negligently.
“We take what happened very seriously. I hope that other organizations will also take the sanction decision on board and, where necessary, review the security of the personal data for which they themselves are responsible,” says Eric Leijonram, Director-General of IMY.
It was in August last year that the attack on the systems provider Miljödata took place. Miljödata has a large share of the municipalities as customers and a number of listed companies.
