Sweden’s privacy regulator fined software provider Miljödata after a 2025 cyberattack exposed sensitive personal data from systems used by municipalities across the country. The August 2025 breach disrupted services in more than 200 regions, affected about 2.2 million people, and involved extortion by a threat actor calling itself Datacarry. Regulators said Miljödata violated GDPR Article 32 by failing to sufficiently check newly installed software and lacking automated real-time intrusion monitoring.
Why it matters: This matters because Miljödata’s systems are widely used by Swedish municipalities, so the breach exposed highly sensitive HR and case data at broad public scale. Public-sector customers and affected users should watch for follow-on fraud or phishing, while organizations using similar software should review monitoring, software-change controls, and third-party risk now.
Bill Toulas
2026.09.22
100% relevant
This article establishes a distinct story by adding official regulatory findings and a financial penalty tied to Miljödata’s August 2025 breach affecting 2.2 million people.
← Back to all stories