IMY fines Miljödata SEK for Article 32 GDPR violation after ransomware breach of 2.2M

1(17) Environmental Data in Karlskrona Aktiebolag Case Number: Decision Following an Inspection Pursuant to IMY-2025-21177 Date: General Data Protection Regulation – Miljödata i September 22, 2026 Karlskrona Aktiebolag Decision of the Swedish Data Protection Authority The Swedish Data Protection Authority finds that Miljödata i Karlskrona Aktiebolag (556324-4036) has processed personal data in violation of Article 32(1) of 1 the General Data Protection Regulation. The Swedish Data Protection Authority decides, pursuant to Articles 58(2) and 83 of the General Data Protection Regulation, that Miljödata i Karlskrona Aktiebolag shall pay an administrative fine of 1,800,000 kronor for the violation of Article 32(1) of the General Data Protection Regulation. Mailing Address: P.O. Box 8114 104 20 Stockholm Website: www.imy.se Email: imy@imy.se 1 Phone: Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with respect to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). the free movement of such data and repealing 08-657 61 00 Swedish Data Protection Authority Reference number: IMY-2025-21177 2(17) Date: September 22, 2026 Summary Miljödata i Karlskrona Aktiebolag (Miljödata) is a provider of digital system support for human resources and occupational health and safety management.

Miljödata provides web-based services to customers for managing, among other things, sick leave, rehabilitation, and near-miss incidents. In August 2025, the company was subjected to a data breach by an external attacker who accessed information for which they lacked authorization within the services (unauthorized access). The breach was detected by Miljödata, which reported the personal data breach to IMY on August 26, 2025. Following the incident, Miljödata identified indications that the threat actor had extracted data from the systems, and the leaked information, which contained personal data, was published shortly thereafter on the Darknet. IMY has reviewed whether Miljödata, prior to and at the time of the personal data breach, had implemented appropriate technical and organizational measures in accordance with Article 32(1) of the General Data Protection Regulation to protect the personal data processed in its services.

The review shows that the processing of personal data required a high level of security and that Miljödata has not taken sufficient measures to ensure that the personal data processed in the company’s services was protected against the risk of unauthorized disclosure or unauthorized access as a result of a data breach. Nor has the company implemented sufficient security measures, as it lacks automatic real-time monitoring to identify threats such as suspicious activity, intrusions, or attempted intrusions that could lead to unauthorized access. IMY assesses that Miljödata has acted negligently with regard to the violation of the General Data Protection Regulation that has been established and that all other conditions for imposing an administrative fine on Miljödata have been met. IMY decides that Miljödata shall pay an administrative penalty of 1,800,000 kronor for the violation of Article 32(1) of the General Data Protection Regulation.

In determining the amount of the administrative fine, the high severity of the violation and the company’s revenue have been taken into account. IMY assesses that the amount is effective, proportionate, and dissuasive.Swedish Data Protection Authority Reference Number: IMY-2025-21177 3(17) Date: September 22, 2026 Summary of the Supervisory Case Background The Privacy Protection Authority (IMY) has initiated a supervisory investigation against Miljödata i Karlskrona Aktiebolag (Miljödata) in connection with a personal data breach that occurred on August 20, 2025, and was reported by Miljödata to the IMY on August 26, 2025. Miljödata is a provider of digital system support for human resources and occupational health and safety management. The company provides web-based services (the services) primarily for managing sick leave, rehabilitation, near-miss incidents, and occupational health and safety efforts for both private and public sector clients.

The majority of the data subjects in the services are employees of Miljödata’s clients. Miljödata’s personal data breach notification states, among other things, that the company has been subjected to a data breach by an external attacker (the threat actor) and that the threat actor has gained access to information for which it lacked authorization within the services (unauthorized access). The breach was discovered on August 23, 2025, after a technical alert regarding an error in the services was triggered in IT operations. IMY’s review of the case concerns the question of whether Miljödata, prior to and at the time of the personal data breach had taken appropriate technical and organizational measures in accordance with Article 32(1) of the General Data Protection Regulation to protect the personal data processed in the services. Miljödata’s Statement Miljödata maintains that the company has in no way processed personal data in violation of the General Data Protection Regulation and has, in addition, stated the following in essence.

On September 14, 2025, the threat actor published portions of the leaked information, which contained personal data, on the Darknet. Cause of the breach and its scope Miljödata’s forensic investigation has shown that the threat actor’s method involved exploiting a vulnerability in a support component for a firewall solution that Miljödata had purchased from a reputable supplier of such products. According to 2IMY’s explanation: An SQL injection is a data breach method that exploits a vulnerability in SQL. SQL is a programming language used to query relational databases and to modify and update databases. The Swedish Data Protection Authority Reference Number: IMY-2025-21177 4(17) Date: September 22, 2026 Through this vulnerability, the threat actor was able to gain access to Miljödata’s technical environment via an SQL injection. The support component for the firewall solution was installed on Miljödata’s server approximately seven days before the incident.

The threat actor was able to escalate their privileges and move laterally within Miljödata’s technical environments, gaining access to Miljödata’s servers. This occurred despite the fact that Miljödata had two-factor authentication enabled on internal services in its technical environment as well as separate access accounts for different roles within the company both before and at the time of the incident. The Process for Installing New Components The process for installing and approving new components or systems in Miljödata’s infrastructure is carried out by a system administrator and includes analyses of, among other things, requirements and technical dependencies, as well as the impact on operations and security. The analysis documentation is then reviewed in consultation with other system engineers, and decisions are made in consultation with a supervisor, whereby any necessary tests and risk-mitigation measures are determined before the component is integrated.

When installing the relevant support component, Miljödata had no reason to suspect that the installed version was not the latest, since it was a costly product supplied by a well-known vendor. Consequently, the question of verifying the version or whether it had known vulnerabilities, or to update it after installation. Monitoring System At the time of the incident, Miljödata had an operational monitoring system provided by the server provider, supplemented by the company’s own functional and operational monitoring. Miljödata’s monitoring system did not trigger an alert regarding suspicious activity in connection with the breach on August 20, 2025, and thereafter. The resilience of the EDR solution 3 used by the company proved to be insufficient. Miljödata detected the breach when technical alerts were triggered regarding service errors on August 23, August 2025. All servers were isolated by Miljödata, and an external incident response team was activated by Miljödata that same evening.

Following the incident, the EDR solution and SOC monitoring have been implemented 24/7. 3 IMY’s explanation: An EDR (Endpoint Detection and Response) solution is a security program that monitors the network’s endpoints to detect suspicious activity.The Swedish Data Protection Authority Reference Number: IMY-2025-21177 5(17) Date: September 22, 2026 Risk assessments and security measures taken Miljödata conducts continuous and structured security work and, at the time of the incident, had relevant organizational and technical safeguards in place, such as multi-layered protection, access and authorization controls, logging, monitoring, and incident response. Risk assessments are conducted at strategy meetings and board meetings, as well as on an ongoing basis as needed. The risks associated with the processing of personal data in the services have, at a general level, been assessed as low.

This assessment was conducted within the framework of Miljödata’s systematic information security and risk management efforts and is based on a survey of processing activities, the classification of personal data, and a comprehensive threat and vulnerability analysis. In the threat and vulnerability analysis, the risk of cyberattacks was given special consideration, and the likelihood of cyberattacks was assessed as relatively low, partly in light of Miljödata’s limited public profile. The consequences of a potential attack on the freedoms and rights of data subjects were assessed as significant. In the threat and vulnerability analysis conducted by Miljödata regarding the processing in its services, risks were identified including unauthorized access and account takeover, incorrect assignment of access rights, malware, and operational and vendor-related risks. However, after implementing preventive technical and organizational measures, the risks were assessed as low.

Risks have been identified and managed on an ongoing basis, including in connection with the design, development, and further development of systems. The systems have been designed based on consistently high security standards and in accordance with the principles of built-in data protection and data protection by design. The services involved the processing of sensitive personal data, including, among other things, sick leave, rehabilitation documentation, and personnel notes. The impact of unauthorized access, as well as the need for protective measures, was assessed to be greater for this type of data. Measures were taken in the form of encrypting attachments and data in free-text fields by Miljödata within the services. Personal data in the services and data controller The personal data breach affected approximately 2,200,000 individuals. The breach involved personal identification numbers, contact information, employment and organizational data, as well as absence data.

To a limited extent, children are included among the data subjects affected by the incident in cases where they were employed by one of the customers or were involved in cases regarding student incidents recorded in the services. The personal data processed in the services also includes sensitive personal data, such as sick leave data, documentation related to student incidents, rehabilitation documentation, and personnel notes. To a certain extent, protected personal data has been processed in the services, even though the initial assumption was that such data was not intended to be processed in the services. Miljödata acts as a data processor for the processing of personal data that takes place in the services on behalf of customers. In cases where the services are provided to customers via third-party agreements with other providers, Miljödata acts as a sub-processor. In addition, Miljödata is, to a limited extent, the data controller for the processing that relates to Miljödata’s own staff as well as certain customer, system, and supplier administration that involves personal data.

The Swedish Data Protection Authority Reference Number: IMY-2025-21177 6(17) Date: September 22, 2026 Measures Taken in Response to the Incident Miljödata isolated all servers approximately one hour after the incident was detected on August 23, 2025. An external incident response team and an internal task force were activated by Miljödata, and incident management included immediate isolation, a forensic investigation, and remediation of compromised systems, followed by the restoration of encrypted servers. Furthermore, the response included, among other things, rebuilding affected domain controllers to restore a trusted identity infrastructure and measures were taken to prevent the threat actor from gaining continued or further access. A comprehensive cleanup process was carried out to ensure that the environment was free of any remaining malware. Security solutions were decommissioned and replaced with new ones, and additional security measures were implemented in the environment in the form of EDR and SOC monitoring 5 around the clock to strengthen detection and response capabilities.

In parallel with the technical incident response, reports were filed with IMY and the Police Authority, and contact was made with the relevant authorities. Structured communication channels were established with all customers, and Miljödata worked intensively to engage in direct dialogue with every affected party. All data controllers were provided on an ongoing basis with documentation for incident reporting, including updates as new forensic findings were verified. To ensure transparency and coordination, , an informational meeting was held with the Swedish Civil Contingencies Agency and its departments, briefings were conducted with the Swedish Association of Local Authorities and Regions that were open to public organizations and private clients, and a separate informational meeting was held that was open to all of Miljödata’s clients. Reasons for the Decision Applicable Provisions, etc. Data Controller According to Article 4(7) of the General Data Protection Regulation, a “data controller” means a natural or legal person, public authority, agency, or other body that, alone or jointly with others, determines the purposes and means of the processing of personal data.

If the purposes and means of the processing are determined by Union law or the national law of the Member States, the controller or the specific criteria for designating the controller may be provided for in Union law or in the national law of the Member States. According to Article 4(8) of the General Data Protection Regulation, a “data processor” means a natural or legal person, public authority, agency, or other body that processes personal data on behalf of the data controller. A provider offering standardized services may act as a data processor, while its users act as data controllers to the extent that the latter have determined the purpose of the processing and, in any case, exercise 6 substantial influence over the methods of processing. It should be noted, however, that such a service provider may act as a data controller for certain processing activity and as a data processor for another activity.

To determine 4IMY’s explanation: A domain controller is a server that, within a domain in a Windows network, handles matters related to login, authentication, and authorization. 5IMY’s explanation: SOC (Security Operations Center) monitoring involves continuous real-time analysis of an organization’s IT environment to identify, assess, and mitigate security incidents. 6See the European Data Protection Board’s (EDPB) Guidelines 07/2020 regarding the concepts of data controller and data processor in the GDPR, p. 85.Swedish Data Protection Authority Reference Number: IMY-2025-21177 7(17) Date: September 22, 2026 To determine how responsibility for personal data is allocated, it is necessary to conduct an analysis for each activity to assess the degree of influence each party has had, in order to determine who has determined the purposes and means of the processing in question. 7 The Requirement to Implement Appropriate Security Measures According to Article 32(1) of the General Data Protection Regulation, both data controllers and data processors must implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk posed by the processing.

When assessing which technical and organizational measures are appropriate, the latest technological developments, the costs of implementation, and the nature, scope, context, and purposes of the processing, as well as the risks to the rights and freedoms of natural persons, shall be taken into account. According to Article 32(1) of the Regulation, appropriate security measures include, where appropriate, a. pseudonymization and encryption of personal data, b. the ability to ensure, on an ongoing basis, the confidentiality, integrity, availability, and resilience of processing systems and services, c. the ability to restore the availability and access to personal data within a reasonable timeframe in the event of a physical or technical incident, d. a procedure for regularly testing, assessing, and evaluating the effectiveness of the technical and organizational measures intended to ensure the security of the processing.

According to Article 32(2) of the General Data Protection Regulation, when assessing the appropriate level of security, special consideration must be given to the risks posed by the processing, in particular the risk of accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or unauthorized access to the personal data that has been transferred, stored, or otherwise processed. The Court of Justice of the European Union has held that the reference in Article 32 to a “level of security that is appropriate in relation to the risk” and “appropriate level of security,” respectively, indicates that the Regulation establishes a risk management system and that the Regulation’s objective is in no way to eliminate the risks of personal data breaches. The wording of the provision merely imposes an obligation on the data controller to implement technical and organizational measures to prevent personal data breaches to the greatest extent possible.

The assessment of whether such measures are appropriate 8 must be based on the specific circumstances of the individual case. Recital 75 of the General Data Protection Regulation states that, when assessing the risk to the rights and freedoms of natural persons, various factors must be taken into account. Among other things, it mentions personal data subject to professional secrecy, data concerning health or sex life, whether the processing involves vulnerable natural persons, particularly children, or whether the processing involves a large amount of personal data and concerns a large number of data subjects. Recital 76 of the General Data Protection Regulation states that the likelihood and severity of the risk to the data subject’s rights and freedoms should be determined based on the nature, scope, context, and purposes of the processing. The risk should be assessed on 7See EDPB Guidelines 07/2020, p. 80. 8See the judgment of the Court of Justice of the European Union of December 14, 2023, Natsionalna agentsia za prihodite, C-340/21, EU:C:2023:986, p. 29 and 30.

Swedish Data Protection Authority Reference Number: IMY-2025-21177 8(17) Date: September 22, 2026 based on an objective assessment that determines whether the processing involves a risk or a high risk. Sensitive personal data and personal data deserving special protection Health data belongs to the special categories of personal data, known as sensitive personal data, which are afforded particularly strong protection under the General Data Protection Regulation. It is prohibited to process such personal data under Article 9(1) of the General Data Protection Regulation, unless the processing falls under one of the exceptions in Article 9(2) of the Regulation. Health data is defined in Article 4(15) of the General Data Protection Regulation as personal data relating to a natural person’s physical or mental health that provides information about that person’s health status. Recital 35 of the General Data Protection Regulation states that personal data concerning health should include all data relating to a data subject’s health status that provides information about the data subject’s past, current, or future physical or mental health status.

Recital 38 of the General Data Protection Regulation states that children’s personal data deserves special protection, as children may be less aware of the risks, consequences, and protective measures involved, as well as of their rights regarding the processing of personal data. It follows from Article 87 of the General Data Protection Regulation and Chapter 3, Section 10 of the Act (2018:218) containing supplementary provisions to the EU General Data Protection Regulation, personal identification numbers and coordination numbers are afforded special protection. IMY’s Assessment Data Controller The investigation into this matter shows that Miljödata primarily acts as a data processor for the personal data processed in the services. To a limited extent, Miljödata acts as a data controller for the personal data in the services. Since the obligation to implement appropriate measures under Article 32 of the General Data Protection Regulation applies to both data controllers and data processors, IMY will not assess in detail what role the company has played in relation to each processing activity.

The processing has required a high level of security Under Article 32 of the General Data Protection Regulation, Miljödata has had an obligation to implement appropriate security measures to protect the personal data processed in the services. The investigation shows that it is Miljödata that designs and provides the services in question and thus has had the actual ability to implement such measures. In assessing which measures were appropriate and what level of security the processing required in this case, IMY takes the following into account. The processing of personal data in the services has been extensive. Miljödata has stated that approximately 2,200,000 individuals were registered in the services and affected by the personal data breach. The company has over 300 customers throughout Sweden, a large proportion of whom are municipalities, regions, and other public entities. The services contained approximately 20 pieces of personal data about each registered individual, such as information regarding name, contact details, personal identification number, and employment and organizational details.

IMY assesses that access to the information made it possible to directly deduce a large amount of information about each data subject, which made the processing particularly sensitive in terms of privacy. The Swedish Data Protection Authority Case Number: IMY-2025-21177 9(17) Date: September 22, 2026 IMY further considers that the personal data processed in the services was of such a that the processing entailed high risks to the rights and freedoms of the data subjects. The services that Miljödata offered to its customers primarily concerned the management of, among other things, sick leave, rehabilitation, work-related injuries, and near-miss incidents. This has thus involved extensive processing of sensitive personal data concerning health, such as information on sick leave, data in rehabilitation documents, and in medical certificates. The processing of such data may constitute a particularly serious infringement of the fundamental rights regarding respect for private life and the protection of personal data.

The services have also processed personal data on children, who are considered a special category of data subjects under the General Data Protection Regulation, as well as other special categories of personal data in the form of personal identification numbers and protected personal data. In summary, IMY finds that this has involved extensive processing of personal data, considering both the number of data subjects involved and the amount of data regarding each data subject. This, combined with the nature of the data—which largely consisted of sensitive personal data as well as data requiring special protection regarding, among other things, children—has posed a high risk to the freedoms and rights of natural persons. Unauthorized disclosure or unauthorized access to the personal data could have led to serious consequences for the individuals concerned. This has necessitated a high level of security for the processing in the form of adequate security measures to ensure the resilience of the services and the effectiveness of the technical and organizational measures the company has implemented to maintain the security of the processing.

Miljödata has not implemented sufficient security measures IMY will then assess whether Miljödata has implemented the technical and organizational measures that, given the high risks involved, would have been appropriate to protect the personal data in the service. Inadequate measures to prevent the breach The investigation into the matter shows that, approximately one week before the incident, Miljödata installed a support component for a firewall solution on a server at Miljödata. The support component was supplied by a well-known vendor. The installation of the support component was carried out by Miljödata. However, the version that the vendor provided to Miljödata was outdated and contained a known critical vulnerability. Information about the vulnerability was available on the vendor’s website more than a year before the installation at Miljödata was carried out. Miljödata has stated that the threat actor exploited the vulnerability in the support component via an SQL injection and thereby gained access to Miljödata’s technical environment.

IMY has no reason to question this information. IMY notes that the responsibility under Article 32(1) of the General Data Protection Regulation includes, among other things, the ability to continuously ensure the resilience of services, as well as regularly testing, examining, and evaluating the effectiveness of the technical and organizational measures intended to ensure the security of processing. In this case, it has emerged that Miljödata has a process for the installation and approval of new components, including, among other things, a needs analysis and an assessment of the impact on operations and security. However, Miljödata has stated that the company saw no reason to verify that it had received the expected version of the support component from 9See the judgment of the Court of Justice of the European Union of August 1, 2022, C-184/20, Vyriausioji tarnybinės etikos komisija, EU:C:2019:773, p. 126.

Swedish Data Protection Authority Case No.: IMY-2025-21177 10(17) Date: September 22, 2026 the supplier, in part because it was a high-cost product from a well-known supplier. IMY notes that Miljödata was responsible for ensuring adequate protection of personal data in the services. As stated above, the nature and scope of the processing of personal data required a high level of protection. Furthermore, the relevant support component was installed on a server exposed to the internet, which in itself poses an increased risk of intrusion and thus required a high level of security for the processing. Since, as in this case, the software was new and had not undergone testing in a test environment before being integrated into an IT system, it was particularly important that the correct version of the security component be installed. IMY further notes that the vulnerabilities in the outdated version were known.

Against this background, IMY assesses that it was a fundamental security measure to verify that the correct version of the component was installed. Miljödata should therefore have performed such a check before the component was integrated into the company’s IT system. By failing to perform such a check, Miljödata installed a version of the support component containing a critical vulnerability that was subsequently exploited by the threat actor. By failing to implement such security measures, IMY assesses that Miljödata has not taken sufficient technical and organizational measures in relation to the risk of unauthorized disclosure and unauthorized access. Inadequate measures to detect intrusions or attempted intrusions and to limit the scope of the intrusion The investigation into the matter shows that the intrusion began on August 20, 2025, and that technical alerts regarding service errors were triggered on August 23, 2025.

The attacker was thus present in Miljödata’s technical environment for three days and was able to move laterally between servers in Miljödata’s technical environment and begin encrypting the company’s servers before Miljödata’s monitoring system triggered an alert. According to Miljödata, the monitoring system, which was intended to detect intrusion attempts, was not sufficiently resilient. The investigation reveals that, following the incident, Miljödata implemented real-time monitoring (SOC monitoring) around the clock. IMY notes that the monitoring systems used by Miljödata were primarily focused on monitoring system performance and availability. The technical and organizational security measures that Miljödata had implemented to monitor security-related events have therefore not been sufficient to detect or warn of the initial intrusion attempts, the threat actor’s movements within the systems, the encryption or the transfer of personal data.

The threat actor was thus able to bypass virus detection, security monitoring, and multi-factor authentication, as well as grant itself high-level privileges on the server where the support component was installed. The threat actor was able to further move laterally between servers in Miljödata’s technical environment for several days without being detected. IMY assesses that the threat actor gained access to more information during the breach because the monitoring system used by Miljödata did not alert them to the intrusion in a timely manner. Given the high risks associated with the processing of personal data, , IMY assesses that it was a fundamental security measure for Miljödata to have automatic real-time monitoring to identify threats in the form of, for example, suspicious activity and intrusions or intrusion attempts that could lead to unauthorized access. If such measures had been taken, Miljödata would have been better positioned to, at an earlier stage, detect the intrusion and consequently limit its scope.

The Swedish Data Protection Authority Reference Number: IMY-2025-21177 11(17) Date: September 22, 2026 detect the breach at an earlier stage and, consequently, limit its scope. By failing to take such measures, IMY assesses that Miljödata has not taken sufficient measures to ensure an appropriate level of security. Summary Assessment Overall, IMY finds that the processing of personal data required a high level of protection. IMY assesses that Miljödata, by failing to verify that the relevant support component was the correct version prior to installation, has not taken sufficient measures to ensure that the personal data processed in the company’s services was protected against the risk of unauthorized disclosure or unauthorized access resulting from a data breach. Furthermore, the company did not implement sufficient security measures by failing to have automatic real-time monitoring to identify threats in the form of, for example, suspicious activity and intrusions or intrusion attempts that could lead to unauthorized access.

If such measures had been implemented, the company would have been better positioned to detect the breach at an earlier stage and, consequently, limit its scope. Against this background, IMY assesses that Miljödata has processed personal data in violation Article 32(1) of the General Data Protection Regulation by failing to implement appropriate technical and organizational measures to ensure an appropriate level of security for personal data in the services prior to and at the time of the personal data breach that was identified on August 23, 2025. Choice of Remedial Action Miljödata’s Statements Miljödata has essentially stated the following regarding the choice of corrective action. If IMY considers that the company has acted in violation of Article 32 of the General Data Protection Regulation, there are several circumstances that mean the company should not be subject to a penalty. Should IMY conclude that a penalty is warranted, these circumstances are of such a nature that the only effective, proportionate, and deterrent penalty is a reprimand.

The criminal breach suffered by the company cannot be considered to be of a high degree of severity. The incident was not caused by any intentional or negligent conduct on the part of the company. On the contrary, the company has implemented more extensive security measures than required under the General Data Protection Regulation. Although a large number of data subjects were affected by the incident, they have not suffered any significant concrete harm. Personal data of a more privacy-sensitive nature was involved only to a limited extent. The fact that neither any data controller nor any data subject has made any concrete and specific claim against the company regarding the incident confirms that, in practice, no actual harm has occurred. The company limited the duration of the incident through measures taken in the form of technical monitoring that triggered an alarm and the immediate isolation of all servers.

The fact that the company had encrypted, among other things, attachments and free-text fields, this limited the scope of the incident and, consequently, the harm that data subjects may have suffered. The prompt and coordinated measures taken by the company have resulted in the duration and scope of the incident being limited. The Swedish Data Protection Authority Reference Number: IMY-2025-21177 12(17) Date: September 22, 2026 The company has cooperated fully with the IMY throughout the handling of this case and reported the incident to the IMY itself within the statutory time limit. The company has furthermore kept the affected data controllers and relevant authorities informed on an ongoing basis, which has enabled the data controllers to take additional protective measures and to report the incident to IMY. In addition, the company has held individual meetings with several hundred customers and served as a coordinating body for the Swedish Association of Local Authorities and Regions, to which the majority of customers are affiliated.

Following the incident, the company has once again reviewed its security measures, which has led to changes to and additional investments in technical and organizational security measures to prevent future breaches. The incident has caused the company significant costs and a substantial amount of work. Furthermore, the company has not previously been the subject of an investigation under the General Data Protection Regulation. Applicable Provisions, etc. Selection of Corrective Measures and Calculation of the Amount of the Administrative Fine In the event of a violation of the General Data Protection Regulation, IMY has a number of corrective powers at its disposal under Article 58(2)(a)–(j) of the General Data Protection Regulation, including reprimands, injunctions, and administrative fines. Article 83(2) states that IMY shall impose administrative fines in addition to or in lieu of the other measures referred to in Article 58(2), depending on the circumstances of the individual case.

According to Article 83(1), each supervisory authority shall ensure that the imposition of administrative fines in each individual case is effective, proportionate, and dissuasive. Article 83(2) of the General Data Protection Regulation specifies the factors to be taken into account in determining whether an administrative fine should be imposed and what should influence the amount of the fine. Factors relevant to assessing the seriousness of the violation include its nature, gravity, and duration. The European Data Protection Board (EDPB) has adopted guidelines on the calculation of administrative fines under the General Data Protection Regulation, which aim to establish a harmonized methodology and principles for calculating fines. 10 According to Article 83(4) of the General Data Protection Regulation, in the event of violations of, among other things, Article 32, administrative fines of up to 10,000,000 euros shall be imposed, or, if in the case of an undertaking, up to 2 percent of its total worldwide annual turnover during the preceding fiscal year, whichever is higher.

In the case of a minor violation, according to Recital 148 of the General Data Protection Regulation, the IMY may, instead of imposing a penalty, issue a reprimand pursuant to Article 58(2)(b) of the Regulation. Definition of the term “undertaking” When determining the maximum amount of an administrative fine to be imposed on an undertaking , the definition of the term “undertaking” used by the Court of Justice of the European Union in applying Articles 101 and 102 of the Treaty on the Functioning of the European Union (TFEU) shall be used. The calculation of the maximum amount for a data controller that constitutes such an undertaking or is part of such an undertaking shall be based on a percentage of the undertaking’s total global 10See EDPB Guidelines 04/2022 on the calculation of administrative fines under the General Data Protection Regulation, adopted on May 24, 2023. 11See Recital 150 of the General Data Protection Regulation.

The Swedish Data Protection Authority Reference Number: IMY-2025-21177 13(17) Date: September 22, 2026 annual turnover during the preceding fiscal year. The concept of “undertaking” shall also be taken into account when assessing the actual or material financial capacity of the data controller on whom the administrative fine is imposed, thereby verifying whether the administrative fine is effective, proportionate, and dissuasive. 13 A parent company and a subsidiary are considered part of the same economic entity when the parent company exercises decisive influence over the subsidiary. According to the case law of the European Court of Justice, if a parent company owns 100 percent or nearly 100 percent of the shares in a subsidiary, there is a presumption that the parent company exercises decisive influence over the subsidiary’s conduct (the so-called Akzo principle). However, this presumption can be rebutted if the company provides sufficient evidence to demonstrate that the subsidiary acts independently in the market. 14 IMY’s Assessment An administrative fine shall be imposed IMY has determined that Miljödata has processed personal data in violation of Article 32(1) of the General Data Protection Regulation by failing to implement sufficient technical and organizational measures to protect the personal data processed through the company’s services.

This has led to unauthorized access to a large amount of personal data, including sensitive as well as special-category personal data. IMY assesses that this is not a less serious violation that would warrant a reprimand instead of an administrative fine. The Court of Justice of the European Union has clarified that the data controller must have committed a violation intentionally or through negligence for administrative fines be imposed under the General Data Protection Regulation. The Court of Justice has stated in this regard that data controllers may be subject to administrative fines for their actions if they cannot be considered to have been unaware that the conduct constituted a violation, regardless of whether they were aware that they were violating the provisions of the General Data Protection Regulation. 15 Miljödata, in its capacity as a data processor and, to a limited extent, as a data controller, has been responsible for complying with the requirements of the General Data Protection Regulation to implement appropriate technical and organizational measures to ensure an adequate level of protection for the personal data processed in the services.

By failing to take such measures, Miljödata has processed personal data in violation of Article 32(1) of the General Data Protection Regulation. IMY assesses that Miljödata could not have been unaware that its actions constituted a violation of the Regulation. IMY considers that Miljödata has acted negligently with regard to the violation of the General Data Protection Regulation that has been established. All conditions for imposing an administrative fine on Miljödata are therefore met. Which annual revenue should serve as the basis for calculating the administrative fine Miljödata’s annual report for 2025 shows that the company is a wholly owned subsidiary of Persona Grata Informationssystem Aktiebolag. Together, the companies form a group. Since Persona Grata Informationssystem Aktiebolag owns 100 percent of the shares in Miljödata, there is a presumption under the so-called Akzo principle, which does not 12 See the judgment of the Court of Justice of the European Union of December 5, 2023, Deutsche Wohnen, C-807/21, EU:C:2023:950, para. 57. 13See the judgment of the Court of Justice of the European Union of February 13, 2025, ILVA, C-383/23, EU:C:2025:84, para. 36. 14See the judgment of the Court of Justice of the European Union of September 10, 2009, Akzo Nobel et al. v. Commission, C-97/08 P, EU:C:2009:536, paras. 59–61, and its judgment of July 14, 1972, ICI v. Commission, C-48/69, EU:C:1972:70, para. 136. 15See the judgment of the Court of Justice of the European Union of May 4, 2023, Nacionalinis visuomenes sveikatos centras, C-683/21, EU:C:2023:949, para. 81, and of December 5, 2023, Deutsche Wohnen, C-807/21, EU:C:2023:950, p. 76.

Swedish Data Protection Authority Reference Number: IMY-2025-21177 14(17) Date: September 22, 2026 has been refuted in this case, as Persona Grata Informationssystem Aktiebolag exercises a decisive influence over Miljödata’s conduct. IMY assesses that the companies should therefore be regarded as a single economic entity constituting an undertaking within the meaning of Articles 101 and 102 of the TFEU. Since no consolidated financial statements have been prepared for the group, the calculation of the administrative fine shall be based on the combined annual revenue of Persona Grata Informationssystem Aktiebolag and Miljödata for the fiscal year 2025. For that fiscal year, Persona Grata Informationssystem Aktiebolag reported 0 SEK in annual revenue, while Miljödata’s annual revenue amounted to 58,476,045 SEK. Two percent of the company’s total annual revenue for the 2025 fiscal year is thus 1,169,521 kronor.

Since this amount is lower than the fixed maximum amount specified in Article 83(4) of the General Data Protection Regulation, the maximum administrative fine that can be imposed in this case is 10 million euros. The infringement is of a high degree of seriousness When assessing the seriousness of the infringement, consideration must be given, among other things, to its nature, gravity, and duration. The EDPB’s guidelines state that the severity is classified as low, medium, or high. In assessing the severity of the violation, IMY takes the following circumstances into account. The company’s services have been used by a large number of municipalities, regions, and companies throughout Sweden. The processing of personal data has been extensive, and the identified shortcomings have enabled unauthorized access to the data of over two million people. The processing of personal data has involved a large amount of information about each individual, which has led to increased privacy risks.

A large portion of the company’s services has involved the handling of personnel administration matters related to, among other things, sick leave, rehabilitation, and work-related injuries. This has involved the processing of sensitive personal data regarding health and other privacy-sensitive information that warrants special protection. The services have also included personal data about children, who, due to their vulnerability, are entitled to particularly strong protection of their personal data. However, the fact that Miljödata had encrypted personal data in free-text fields and attachments may, to some extent, be considered to have reduced the risk of harm to the data subjects concerned compared to if this had not been the case. IMY assesses, however, that the encryption cannot be taken as evidence that the data was protected from unauthorized access in connection with the breach.

Furthermore, the violation concerned the central processing of personal data for Miljödata’s core operations, where the company may be presumed to have good conditions for implementing appropriate security measures. Consequently, the breach must be considered more serious than it would have been otherwise.8 IMY notes that even unauthorized access to the type of personal data processed in the services causes harm to data subjects. The Court of Justice of the European Union has stated that harm to data subjects can arise simply from the loss of control over their own personal data, even if there has been no concrete misuse of the data in question. In this case, the deficiencies in the protection of personal data have enabled the threat actor to gain access to and subsequently publish personal data from Miljödata’s services on the dark web. IMY therefore considers that Miljödata’s inadequate actions have had a significant 16See EDPB Guidelines 04/2022, p. 60. 17See EDPB Guidelines 04/2022, p. 58. 18See EDPB Guidelines 04/2022, p. 53. 19See the judgment of the Court of Justice of the European Union of December 14, 2023, Natsionalna agentsia za prihodite, C-340/21, EU:C:2023:986, p. 82 and judgment of October 4, 2024, Agentsia po vpisvaniyata, C-200/23, EU:C:2024:827, p. 145.Data Protection Authority Reference Number: IMY-2025-21177 15(17) Date: September 22, 2026 impact on the freedoms and rights of data subjects and that the harm suffered by the affected data subjects means that the violation must be considered more serious.

Depending on the circumstances of the individual case, the assessment of the seriousness of the violation is also influenced by the degree of negligence in relation to the identified 20 deficiencies. In this case, IMY has determined that the deficiencies consisted of the company’s failure to verify that it had received the correct version of the support component in question prior to installation and that this was a fundamental security measure given the nature and scope of the processing. Information that the relevant software component contained vulnerabilities had also been known and available on the supplier’s website for more than a year prior to installation. Given the nature and scope of the processing, it was also essential to have robust monitoring in place. In this regard, the investigation shows that Miljödata had the capacity to implement security measures, as the company introduced automatic real-time monitoring shortly after the personal data breach.

Against this background, IMY assesses that Miljödata has demonstrated negligence of such a degree that the violation should be considered more serious. Taking the foregoing into account, IMY assesses that the violation in question is of a high degree of seriousness. Mitigating and Aggravating Factors When determining the amount of the administrative fine, consideration must also be given to the aggravating and mitigating factors specified in Article 83(2) of the General Data Protection Regulation. The investigation shows that Miljödata, both before and after the incident, has implemented changes and made investments in technical and organizational security measures. Regarding measures taken prior to the incident, Miljödata has, among other things, stated that it should be taken into account that the company had encrypted data in attachments and free-text fields, which, according to the company, constituted adequate protection that directly limited the scope of the incident and the harm the data subject may have suffered.

IMY considers that the measures taken, such as the encryption of attachments and free-text fields, cannot be regarded as going beyond what can be expected of Miljödata, given the nature and scope of the processing. IMY further assesses that it has not been established that the measures taken following the breach have mitigated the harm to the data subjects to such an extent that they should 21 be considered mitigating factors. The fact that Miljödata reported its own personal data breach and cooperated with IMY in the investigation of the incident to the extent that could be expected does not affect the amount of the administrative fine, either upward or downward. 22 Nor does IMY consider that Miljödata’s measures to enable customers to fulfill their obligations to submit incident reports to IMY in a timely manner were of such a nature as to be considered mitigating factors. IMY does, however, take into account, to some extent as a mitigating factor, the information efforts that Miljödata undertook in the immediate aftermath of the incident and before the investigation began.

These efforts have included, among other things, individual meetings with several hundred affected data controllers, which enabled them to take additional security measures. In addition, the company has played a coordinating role vis-à-vis 20See EDPB Guidelines 04/2022, p. 56. 21See EDPB Guidelines 04/2022, p. 74. 22See EDPB Guidelines 04/2022, pp. 95–98.The Swedish Data Protection Authority Reference Number: IMY-2025-21177 16(17) Date: September 22, 2026 Swedish Association of Local Authorities and Regions, to which the majority of customers are affiliated, and has held several informational meetings with affected customers. IMY assesses that, beyond this, there are no aggravating or mitigating factors that affect the administrative fine. Amount of the Administrative Penalty Based on a comprehensive assessment, IMY has determined that Miljödata shall pay an administrative penalty of 1,800,000 kronor.

In determining the amount of the penalty fee, the high severity of the violation and the size of the company have been taken into account. IMY has considered Miljödata’s actions in connection with the incident as a mitigating circumstance. IMY assesses that the amount is effective, proportionate, and dissuasive. __________________________ This decision was made by Director General Eric Leijonram following a presentation by Departmental Attorney Måns Lysén. The following individuals also participated in the final deliberations: Chief Legal Officer David Törngren, Advisor Sara Ahmed, Unit Heads Jenny Bård and Christelle Bourquin, Legal Counsel Erika Palmheden, and IT and Information Security Specialist Andreas Majunie. Eric Leijonram Appendix Information on payment of the administrative fine. 23 The EDPB’s Guidelines 04/2022, pp. 63–69, explain how a company’s annual turnover can affect the calculation of the amount of the administrative fine, which is based on the fixed amount of 10,000,000 euros.

Swedish Data Protection Authority Reference Number: IMY-2025-21177 17(17) Date: September 22, 2026 How to File an Appeal If you wish to appeal the decision, you must write to IMY. In your letter, specify which decision you are appealing and the change you are requesting. The appeal must be received by IMY within three weeks of the date you were notified of the decision. However, if you are a party representing the government, the appeal must be received within three weeks of the date on which the decision was announced. If the appeal is filed on time, IMY will forward it to the Administrative Court in Stockholm for review. You may email the appeal to IMY if it does not contain any privacy-sensitive personal information or information that may be subject to confidentiality. The agency’s contact information is provided on the first page of the decision.