# AEPD fines Alkora, S.A. for ransomware breach exposing 40,000 individuals' data

- Type: Enforcement
- Source: AEPD (Spain)
- Date: 2026-07-16
- Original: https://gdprhub.eu/index.php?title=AEPD_(Spain)_-_PS-00020-2025
- Canonical: https://overview.legal/posts/53655
- Topics: DPIA, Privacy Impact Assessment, Security, Data Breaches, Encryption, Integrity and Confidentiality Principle, Notification Obligation, Health Data, Controllers, Insurance

## Summary

Facts — Alkora, S.A., the controller, is an insurance broker that was victim of a ransomware attack. The controller notified the DPA of a personal data breach after a ransomware attack affected its servers, databases, email systems and employee devices. The controller first estimated that 25,000 persons were affected. It later stated that the incident had affected around 40,000 persons, including 75 minors. The incident affected confidentiality, availability and integrity. The attacker encrypted systems and exfiltrated between 3.5 and 4 TB of information from the document management server. The affected data included identification and contact data, ID numbers, dates of birth, financial and insurance data, bank account numbers, health data, employee data and access credentials. The controller also processed data relating to minors in accident claims. A data subject complained to the DPA after being informed that their personal data had been exposed. The data subject was concerned about identity theft and requested additional information from the controller. During the investigation, the DPA found that the controller had known that its IT systems faced an extreme cybercrime risk before the breach. The forensic report could not determine the initial entry point because the servers had been encrypted, but it showed that attackers could move laterally through the infrastructure, obtain privileged access, install tools, exfiltrate data and encrypt systems. The controller had carried out a risk analysis in 2019, but this document concluded that no DPIA was necessary. After the breach, a later analysis found that a DPIA was necessary for treatments involving health data and minors. The controller did not prove that it had carried out the required DPIA. Holding — The DPA held that the controller violated Article 5(1)(f) GDPR. It considered that the controller had failed to ensure the integrity and confidentiality of the personal data under its responsibility. The DPA emphasised that the principle in Article 5(1)(f) GDPR is not limited to the existence of isolated security measures. Rather, the controller must implement adequate technical and organisational measures capable of ensuring that personal data is protected against unauthorised or unlawful processing, loss, destruction or damage. The DPA rejected the controller’s argument that the attack was an external criminal act that could not be attributed to it. The DPA found that the controller was aware of an extreme cyber risk and that its internal vulnerabilities and security posture allowed the attackers to move through the systems, access personal data and encrypt files. The DPA therefore considered that the controller’s measures were clearly insufficient. The DPA also held that the controller violated Article 35 GDPR. The controller processed high-risk categories of data, including health data and data concerning minors. In these circumstances, it should have carried out a DPIA before the processing. The DPA found that the controller’s 2019 risk analysis wrongly concluded that no high risk existed, while its later documentation acknowledged that a DPIA was necessary. The DPA proposed a fine of €150,000 for the infringement of Article 5(1)(f) GDPR and €100,000 for the infringement of Article 35 GDPR, totalling €250,000. The controller paid voluntarily without acknowledging liability, obtaining a 20% reduction under Spanish Administrative Law (39/2015). The final payable amount was therefore €200,000. The DPA also ordered the controller, under Article 58(2)(d) GDPR, to prove within three months from the enforceability of the decision that it had carried out the mandatory DPIA required under Article 35 GDPR.

## Full text

Case No.: EXP202400624 DECISION TO TERMINATE THE PROCEEDINGS DUE TO VOLUNTARY PAYMENT Regarding the proceedings conducted by the Spanish Data Protection Agency and based on the following BACKGROUND FIRST: On April 15, 2025, the Presidency of the Spanish Data Protection Agency decided to initiate disciplinary proceedings against ALKORA EBS CORREDURIA DE SEGUROS Y REASEGUROS SAU (hereinafter, ALKORA). Following notification of the decision to initiate proceedings and after analyzing the arguments submitted, a proposed resolution was issued on February 16, 2026, the text of which is transcribed below: > SECOND: On February 18, 2026, ALKORA paid the penalty in the amount of 200,000.00 euros, taking advantage of the reduction provided for in the draft resolution transcribed above. THIRD: The draft decision transcribed above established the facts constituting the infringement and proposed that the Presidency require the controller to adopt appropriate measures to bring its actions into compliance with the regulations, in accordance with the provisions of the aforementioned article 58(2)(d) of the GDPR, according to which each supervisory authority may “order the controller or processor to bring processing operations into compliance with the provisions of this Regulation, where appropriate, in a specific manner and within a specified time limit…”. LEGAL GROUNDS I Jurisdiction In accordance with the powers granted to each supervisory authority by Article 58(2) of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter GDPR), and pursuant to the provisions of Articles 47, 48(1), 64(2), and 68(1) of Organic Law 3/2018 of December 5 on Data Protection and the Guarantee of Digital Rights (hereinafter LOPDGDD), the Presidency of the Spanish Data Protection Agency has jurisdiction to rule on this proceeding. Likewise, article 63.2 of the LOPDGDD provides that: “Proceedings handled by the Spanish Data Protection Agency shall be governed by the provisions of Regulation (EU) 2016/679, this Organic Law, the implementing regulations issued thereunder, and, to the extent they do not conflict with the foregoing, on a subsidiary basis, by the general rules on administrative proceedings." II Conclusion of the Procedure Article 85 of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter LPACAP), under the heading “Termination of Sanctioning Proceedings,” provides as follows: “1. Once disciplinary proceedings have been initiated, if the offender acknowledges liability, the proceedings may be concluded by imposing the appropriate penalty. 6 Jorge Juan Street, 28001 – Madrid74/76 www.aepd.es sedeaepd.gob.es 2. When the penalty is solely monetary in nature, or when both a monetary penalty and a non-monetary penalty may be imposed but the latter has been found to be inappropriate, voluntary payment by the alleged offender, at any time prior to the final decision, shall result in the termination of the proceedings, except with respect to the restoration of the altered situation or the determination of compensation for damages caused by the commission of the violation. 3. In both cases, when the penalty is solely monetary in nature, the body competent to resolve the proceedings shall apply reductions of at least 20% on the amount of the proposed penalty, which may be cumulative. These reductions must be specified in the notice of initiation of proceedings, and their effectiveness shall be conditional upon the withdrawal or waiver of any administrative action or appeal against the penalty. The reduction percentage provided for in this section may be increased by regulation.” III Voluntary Payment In accordance with the provisions of the aforementioned Article 85 of the LPACAP, the notified proposed resolution allowed you to make a voluntary payment of the proposed penalty, which would result in a 20% reduction of its amount. With the application of this reduction, the penalty would be set at 200,000.00 euros, and its payment would result in the termination of the proceedings, without prejudice to the imposition of the corresponding measures. Following the aforementioned proposed resolution, and before this authority issued a final decision, ALKORA, on February 18, 2026, proceeded to make the voluntary payment, availing itself of the 20% reduction. In accordance with Article 85(3) of the LPACAP, the effectiveness of the aforementioned reduction is conditional upon the withdrawal or waiver of any administrative action or appeal against the penalty. It should be noted that, in accordance with the provisions of the LPACAP, as well as the case law of the Supreme Court on this matter, the alleged liable party’s voluntary payment does not exempt the administration from its obligation to resolve and notify all proceedings, regardless of how they were initiated. Similarly, Article 88 of the aforementioned law establishes that the decision bringing the proceedings to a close shall rule on all issues raised by the data subjects and any other issues arising therefrom. Therefore, in accordance with applicable law and after evaluating the criteria for determining the severity of the sanctions, the Presidency of the Spanish Data Protection Agency RESOLVES: FIRST: TO DECLARE that the violations have been committed and TO CONFIRM the sanctions set forth in the operative part of the proposed resolution transcribed in this resolution. 6 Jorge Juan Street, 28001 – Madrid75/76 www.aepd.es sedeaepd.gob.es The sum of the aforementioned amounts totals 250,000.00 euros. Since ALKORA EBS CORREDURIA DE SEGUROS Y REASEGUROS SAU has made a voluntary payment—albeit without acknowledging liability—the total amount is hereby reduced by 20% pursuant to Article 85 of the LPCAP, resulting in a final amount of 200,000.00 euros. The effectiveness of the aforementioned reduction is conditional, in any case, upon the withdrawal or waiver of any administrative action or appeal. SECOND: DECLARE the termination of proceeding EXP202400624, in accordance with the provisions of Article 85 of the LPCAP. Third party: ORDER ALKORA EBS CORREDURIA DE SEGUROS Y REASEGUROS SAU para que en el plazo de 3 meses desde que la presente resolución sea firme y ejecutiva, notifique a la Agencia la adopción de las medidas descritas en los fundamentos de derecho de la propuesta de resolución transcrita en la presente resolución. FOURTH: NOTIFY ALKORA EBS CORREDURIA DE SEGUROS Y REASEGUROS SAU of this resolution. FIFTH: In accordance with the provisions of Article 85 of the LPACAP, which makes the reduction for voluntary payment conditional upon the withdrawal or waiver of any administrative action or appeal, this resolution shall be final in administrative proceedings and fully enforceable as of the date of its notification. In accordance with the provisions of Article 50 of the LOPDGDD, this Resolution shall be made public. Publication shall take place once the resolution has been notified to the data subjects. Against this resolution, which concludes the administrative proceedings as provided for in Article 114.1.c) of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations, the data subjects may file an administrative appeal with the Administrative Chamber of the National Court, in accordance with the provisions of Article 25 and paragraph 5 of the fourth additional provision of Law 29/1998, of July 13, regulating Contentious-Administrative Jurisdiction, within two months from the day following notification of this decision, as provided for in Article 46.1 of the aforementioned Law. However, in accordance with Article 90.3(a) of the LPACAP, the final administrative decision may be provisionally suspended if the data subject expresses their intention to file a contentious-administrative appeal. If this is the case, the data subject must formally notify the Spanish Data Protection Agency in writing, submitting the notice through the Agency’s Electronic Registry , or through any of the other registries provided for in Art. 16.4 of the aforementioned Law 39/2015 of October 1. The interested party must also submit to the Agency the documentation 6 Jorge Juan Street, 28001 – Madrid76/76 www.aepd.es sedeaepd.gob.es proving that the administrative appeal has been effectively filed. If the Agency is not notified of the filing of the administrative appeal within two months from the day following notification of this decision, it will consider the provisional suspension to have ended. 1331-101025 Lorenzo Cotino Hueso President of the Spanish Data Protection Agency

---
Generated by overview.legal · https://overview.legal/posts/53655 · 2026-08-22