Swedish regulator fines IT provider Miljödata over data breach affecting millions

Sweden’s data protection authority, IMY, has fined IT systems provider Miljödata 1.8 million kronor, about $183,000, for security failures that led to a 2025 cyberattack exposing the personal data of about 2.2 million people.

Miljödata develops work-environment and human resources management systems used by roughly 80% of Sweden’s municipalities. In late August 2025, the company suffered a ransomware attack that disrupted IT services across Swedish municipalities and regions and compromised residents’ sensitive information. The attacker demanded 1.5 bitcoin, worth about $168,000 at the time, to avoid leaking the stolen data, then published it on the dark web under the name "Datacarry." The exposed information included personal identity numbers, contact details, sickness-absence and rehabilitation records, and information related to school incidents involving minors.

IMY opened an investigation in November 2025 to determine whether security shortcomings violated Miljödata’s obligations under the European Union’s General Data Protection Regulation. The agency found that the company failed to adequately check newly installed software and lacked automated, real-time monitoring to detect intrusions and suspicious activity, concluding that Miljödata did not maintain a sufficiently high level of technical and organizational security given the type of personal data it processed. IMY said the failures violated Article 32(1) of the GDPR and imposed the penalty accordingly.

According to Miljödata, the breach traced to a firewall support component the company installed about a week before the attack; the component was outdated and contained a long-known, critical vulnerability. Miljödata has said it had no reason to suspect the installed version, since it was an expensive product from a well-known supplier.

Eric Leijonram, IMY’s director general, said in a statement that Miljödata’s failures allowed a threat actor to obtain information on a large share of Sweden’s population, calling the incident serious. He said he hopes other organizations take note of the sanction and review the security of the personal data they are responsible for.

Miljödata has said on its website that it does not agree with all of IMY’s conclusions and can appeal the fine to an administrative court within three weeks. A police investigation into gross data intrusion and attempted gross extortion related to the breach was conducted but was closed for lack of evidence.

IMY said it has also opened investigations into two municipalities and one region connected to the attack — the city of Gothenburg, the Region of Västmanland and Älmhult municipality — and that additional penalties could follow once those inquiries conclude.