Miljödata Reported 2.2 Million People Affected. Sweden Fined It SEK 1.8 Million
Sweden’s privacy regulator says Miljödata reported 2.2 million people affected by an intrusion, and has imposed a SEK 1.8 million fine. The numbers look mismatched, but the more important part of Sweden’s Miljödata decision is what the regulator says the supplier failed to do before the attack.
Sweden’s Authority for Privacy Protection, IMY, found that Miljödata lacked a sufficiently high level of technical and organisational security for the data it handled. The regulator specifically identified inadequate checks when installing new software and the absence of automated real-time monitoring capable of detecting intrusions and suspicious activity.
The breach concentrated sensitive data from across Sweden
The August 2025 intrusion exposed personal identity numbers, contact details and sensitive records involving sickness absence, rehabilitation and school incidents. Miljödata said 2.2 million people were affected, and the stolen information was later published on the dark web.
The customer footprint included a majority of Sweden’s municipalities, several regions and government agencies, plus many private companies. That concentration turns one supplier’s monitoring and change-control practices into a national-scale data-protection dependency.
Article 32 made ordinary security controls enforceable
IMY found Miljödata negligent and imposed the fine for violating Article 32(1) of the GDPR. The decision does not say that a specific security product would have prevented the incident. It says the overall safeguards were not appropriate for the nature of the personal data and the risk.
The fine is not the end of the enforcement story. IMY has opened separate investigations into two municipalities and one region connected to the attack. Customers cannot assume that outsourcing the application also outsources their accountability for supplier selection, oversight and incident readiness.
- Identify suppliers that aggregate personal data across many business units or public bodies.
- Require evidence of secure deployment and validation when new software is installed.
- Test whether monitoring can detect suspicious activity in real time and whether alerts reach an accountable responder.
- Document which party owns logging, retention, investigation and notification across the service boundary.
- Exercise breach response using the supplier’s actual data model, customer dependencies and recovery process.
- Review whether contract language gives the customer timely access to evidence, not only incident summaries.
The fine divided by the company’s reported affected count is roughly SEK 0.82 per person. That arithmetic is attention-grabbing but incomplete: GDPR fines depend on legal, organisational and financial factors, not a flat price per record. The decision’s strategic value is the regulator’s explicit link between concentrated sensitive data, software-installation controls and continuous monitoring.
For customers, the Miljödata case is a warning about shared exposure. A supplier can be one line in a procurement register while holding enough identity and health-related data to make its controls part of national resilience.
Sources
- Swedish Authority for Privacy Protection enforcement announcement, published and last updated 22 September 2026. IMY provides no publication or update time.
- IMY Miljödata case page and decision materials, dated 22 September 2026.
- BleepingComputer independent report, published 22 September 2026 at 17:40 as displayed. The page does not label the timezone.
