Miljödata’s Fine Leaves Questions for Its Customers
Sweden’s regulator fined Miljödata SEK 1.8 million for poor security. The company reported 2.2 million people affected by an August 2025 intrusion.
IMY found inadequate software-installation checks and no automated, real-time intrusion or suspicious-activity monitoring, despite the information’s sensitivity.
Stolen identity numbers, contact details, sickness-absence, rehabilitation and school-incident records appeared on the dark web. Clients spanned most Swedish municipalities, several regions and government agencies, and many private firms.
The full decision records an outdated firewall support component installed about a week before the incident, with a known critical flaw disclosed in 2024. In the company’s account, SQL injection enabled entry on 20 August 2025; operational fault alarms revealed the breach on 23 August, and notification reached the regulator on 26 August. The regulator considered a pre-installation version check a basic safeguard. The decision prescribes no named security product.
Safeguards under scrutiny
The case record identifies a GDPR Article 32(1) breach. IMY found negligence: technical and organisational safeguards were inappropriate for the information and risk. Separate enquiries into two municipalities and one region continued.
Outsourcing the application cannot stand in for customer oversight. Supplier selection, evidence and incident readiness still need named owners. One provider can connect organisations that otherwise have little in common, making concentrated identity and health-related information a shared dependency.
Supplier questions
- Identify suppliers that aggregate personal data across many business units or public bodies.
- Require evidence of secure deployment and validation when new software is installed.
- Test whether monitoring can detect suspicious activity in real time and whether alerts reach an accountable responder.
- Document which party owns logging, retention, investigation and notification across the service boundary.
- Exercise breach response using the supplier’s actual data model, customer dependencies and recovery process.
- Review whether contract language gives the customer timely access to evidence, not only incident summaries.
Dividing the fine by the reported total gives about SEK 0.82 each. That is arithmetic, not a price on a record or the resulting harm. European guidance on fines considers the infringement, seriousness, business turnover and other circumstances, with legal limits and proportionality. Ask for evidence of installation controls and continuous detection, beyond the penalty.
Sources
- IMY: 22 September 2026; times unspecified.
- Regulator case and decision: 22 September 2026; distinguish initial access, discovery and notification.
- BleepingComputer report: 22 September 2026, 17:40 displayed; timezone unspecified.
- European Data Protection Board calculation guidance: version 2.1, adopted 24 May 2023, minor correction 29 June 2023. General methodology, not an explanation of this exact fine.
