Sweden’s privacy regulator has fined software provider Miljödata SEK 1.8 million, approximately $183,000, following a cyberattack in August 2025. According to the company, the Miljödata data breach affected 2.2 million people.
The regulator, known as IMY, found that Miljödata had failed to provide adequate security for the sensitive personal information in its systems.
Attack Exposed Health and Identity Information
Miljödata provides workplace and HR software to organizations across Sweden. Its customers include municipalities, regional authorities, government agencies and private companies.
During the August 2025 attack, a threat actor obtained a large amount of personal information. The stolen data later appeared on the dark web under the name “Datacarry.”
The records included personal identity numbers and contact details. They also contained information about sickness absence, rehabilitation and incidents involving school pupils.
The attacker demanded 1.5 Bitcoin to prevent publication of the data. Despite that demand, the information appeared online. The breach also disrupted services used by numerous Swedish municipalities and other organizations.
Regulator Identifies Security Failures
IMY opened an investigation in November 2025 to assess Miljödata’s security practices. Its review found two significant shortcomings.
First, the company did not conduct sufficient checks when installing new software. Second, it lacked automated, real-time monitoring to detect intrusions and suspicious activity.
IMY considered those measures inadequate given the volume and sensitivity of the data Miljödata handled. The regulator concluded that the company had acted negligently and breached Article 32(1) of the EU’s General Data Protection Regulation.
As a result, IMY imposed a fine of SEK 1.8 million. The decision addresses Miljödata’s security obligations, rather than assigning responsibility for the attack itself.
Reviews of Public-Sector Customers Continue
The Miljödata data breach affected customers throughout Sweden. IMY says most Swedish municipalities were among the affected organizations, alongside several regions, state agencies and private businesses.
The regulator has also opened separate investigations into two municipalities and one region connected to the incident. Those reviews remain ongoing, and IMY has not announced their outcomes.
The case shows how an attack on one software supplier can expose information held for many customers. It also highlights the importance of checking software changes and detecting suspicious activity promptly when handling sensitive records.
0 responses to “Sweden Fines Miljödata After Breach Affects 2.2 Million People”