On 22 September 2026, Sweden's data protection authority, IMY, announced a SEK 1.8 million fine against Miljödata i Karlskrona AB, a supplier of work environment and HR systems used across Swedish municipalities. The penalty follows a breach in August 2025 in which an attacker took a large volume of personal data, later published on the darknet. According to the company, 2.2 million people were affected.
IMY's findings are short and specific. They read like a checklist any software supplier holding customer data should run against itself.
What's affected
From IMY's announcement:
- Supplier: Miljödata i Karlskrona AB, described by IMY as a system supplier.
- Breach: August 2025. A threat actor obtained a large amount of personal data and later published it on the darknet.
- People affected: 2.2 million, according to the company.
- Data: Personal identity numbers, contact details and sensitive personal data about sick leave, rehabilitation and school incidents.
- Customers affected: Most Swedish municipalities, several regions, government agencies and a large number of private companies.
- Provision: Article 32(1) of the GDPR, which requires security appropriate to the risk.
- Findings: The company did not have a sufficiently high level of technical and organizational security for the data it processed. It did not carry out adequate checks when installing new software. It did not have automatic real-time monitoring to detect intrusions and suspicious activity.
- Assessment: IMY found the company acted negligently.
- Follow-on reviews: IMY has opened reviews of two municipalities and one region linked to the attack. Those are ongoing.
BleepingComputer adds that the attack began on 25 August 2025, disrupted IT services in more than 200 regions, and that the attacker demanded 1.5 Bitcoin before publishing the data.
How to check if you're exposed
If you live in Sweden and worked for or studied in a municipality that used Miljödata, your data may be among what was published. Treat unexpected messages that reference your sick leave, rehabilitation or school records with suspicion.
If you are a supplier processing personal data for public bodies or enterprises, check yourself against IMY's three findings:
- Software installation checks. Can anyone with server access install software or packages on production? Is there an approval step, a record and a check of what is being installed? On a Linux host, compare what is installed against what was approved:
# Debian/Ubuntu: list packages installed in the last 30 days
grep -h " install " /var/log/dpkg.log* 2>/dev/null \
| awk -v d="$(date -d '30 days ago' +%F)" '$1 >= d {print $1, $4}' | sort -u
- Real-time monitoring. Do intrusion signals reach someone who can act within minutes, outside business hours? Log collection without alerting does not meet the bar IMY described.
- Security proportionate to data. Sick leave and school incident data are sensitive categories. Check that encryption, access control and segmentation match that sensitivity, not the sensitivity of an ordinary business app.
If you are a customer of a supplier like Miljödata, IMY's reviews of two municipalities and one region are the signal. Controllers are expected to choose and supervise processors with adequate security.
What to do now
- Put software installation under change control. Require approval for new software and packages on systems that hold personal data, record what was installed and by whom, and scan it before it runs.
- Deploy real-time detection with an on-call owner. EDR or host monitoring that alerts a person, around the clock, on suspicious processes, new admin accounts and large data transfers.
- Classify the data you hold. Map which databases contain sensitive categories under GDPR Article 9 and apply stronger controls there first.
- For controllers, review your processor agreements. Check that each Article 28 agreement requires specific security measures, gives you audit rights and sets a breach notification timeline. Then ask for evidence.
- Keep evidence of your due diligence. If a regulator reviews your choice of supplier, you want to show what you asked, what they answered and how you followed up.
Why it matters
A single HR and work environment supplier served a large share of Sweden's public sector, so one breach reached millions of people across hundreds of organizations. That concentration is common in public sector software.
IMY's decision is also a reminder that regulators look at the basics. Unchecked software installation and missing real-time monitoring are not advanced failures. And by opening reviews of customers as well as the supplier, IMY is showing that buying a service does not transfer the responsibility for choosing it carefully.
Try it yourself
Take one supplier that processes sensitive personal data for you. Ask them two questions from IMY's findings: how do you control software installation on production systems, and what real-time monitoring alerts a person when something suspicious happens? Record the answers and the evidence they provide.
Click through it at your own pace, or open it full screen.
Quick check
Which GDPR article did IMY find was violated?
Article 32(1), which requires appropriate technical and organizational security measures.
What specific failings did IMY identify?
Inadequate checks when installing new software, no automatic real-time monitoring to detect intrusions and suspicious activity, and an overall level of security not high enough for the data processed.
Are Miljödata's customers also under review?
Yes. IMY has opened reviews of two municipalities and one region linked to the attack, and those are ongoing.
