Sweden Fines Miljödata $183,000 Over Breach Affecting 2.2 Million
Summary
Sweden’s IMY fined Miljödata $183,000 after finding inadequate software checks and intrusion monitoring contributed to an August 2025 breach affecting 2.2 million people and exposing sensitive data.
Key points
- The August 2025 breach disrupted IT services in more than 200 regions and affected 2.2 million people.
- Exposed data reportedly included identity numbers, contact details, sickness absence, rehabilitation, and school incidents involving minors.
- The attacker, identified as Datacarry, demanded 1.5 Bitcoin and later published stolen data on the dark web.
- IMY found Miljödata did not sufficiently check newly installed software or use automated, real-time monitoring to detect intrusions.
- The regulator imposed a SEK 1.8 million fine for violating GDPR Article 32(1).
- IMY investigations into two municipalities and one region connected to the attack are ongoing.
Article Details
- Victim Organization
- Miljödata
- Incident Type
- Cyberattack involving data theft and extortion
- Incident Date
- 2025-08-25
- Data Types Exposed
- Personal identity numbers
- Contact information
- Sickness absence information
- Rehabilitation information
- School incident information involving underage individuals
- Affected Records
- 2.2 million people affected
- Operational Impact
- IT services were disrupted across more than 200 regions.
- Ransom Or Extortion
- The attacker demanded 1.5 Bitcoin, valued at $168,000 at the time, to prevent publication of the stolen information. The data was subsequently published on the dark web under the name “Datacarry.”
- Claim Status
- confirmed