Swedish regulator fines a system supplier SEK 1.8 million after sick leave data leaked

On 22 September 2026 the Swedish data protection authority, Integritetsskyddsmyndigheten (IMY), fined Miljödata i Karlskrona SEK 1.8 million over the intrusion the company suffered in August 2025. The intrusion began on 20 August 2025, and the decision describes a ransomware attack in which the attacker had started encrypting servers before Miljödata's monitoring system raised any alarm. IMY finds that the attacker reached more information precisely because the monitoring did not alert on the intrusion in time. According to the company's own account, around 2.2 million people were registered in its services and were caught by the incident, while IMY writes that the shortcomings made unauthorised access to data on more than two million people possible. The company disputes the finding and holds that it has in no way processed personal data in breach of the regulation.

The data included national identity numbers, contact details, employment and organisational data, and sensitive information about sick leave, rehabilitation and incidents involving pupils at school. Miljödata sells web based services for personnel and working environment management to more than 300 customers across Sweden, a large share of them municipalities, regions and other public bodies. About a week before the break in, the company installed a support component for a firewall product on an internet facing server, and the version the vendor supplied was out of date and carried a known critical vulnerability that had been described on the vendor's own website for more than a year. Miljödata did not verify whether the version was current, and its explanation in the decision is that the product was expensive and came from a well known vendor. IMY holds that two basic security measures were missing: a check of the version before installation, and automatic real time monitoring, since the monitoring the company had in place tracked performance and availability above all. The attacker exploited the vulnerability through SQL injection, granted itself high privileges on the server where the component was installed, bypassed virus detection, security monitoring and multi factor authentication, and moved between servers for three days.

During the night of 23 August 2025 the encryption of several servers began, and the information was taken out after that. Technical alarms about a service fault went off that afternoon, the company isolated every server, the first indications that data had been taken came only on 2 September, and on 14 September 2025 the attacker published part of the material on the darknet. Miljödata acts as a processor for the personal data in the services and as a controller only to a limited extent, and because Article 32(1) binds both roles, IMY did not settle which role applied to each processing activity. The company turned over SEK 58.5 million in 2025, and two per cent of that is close to SEK 1.17 million, but the ceiling is the higher of two per cent of annual turnover and EUR 10 million, so the maximum available in this case was EUR 10 million. IMY graded the infringement at the high level of severity and the company as negligent, while the information work the company did straight after the incident, including meetings with several hundred affected customers, counted to some extent in mitigation. After the attack IMY also opened reviews of two municipalities and one region, and those cases are still ongoing, while the decision against Miljödata can be appealed within three weeks, with the Administrative Court in Stockholm as the venue.

What this means for you if you buy specialist systems

Buying a specialist system means buying the supplier's routine for installing new software. Miljödata had a process with a needs analysis and an assessment of operations and security, yet nobody checked which version was actually in the package from the vendor. Our reading of the decision is that a familiar vendor name is not a control. The question to put to your own suppliers is who verifies versions and known vulnerabilities before a component lands on an internet facing server, and where that answer is written down.

Note too that two factor authentication was switched on internally, and that the attacker still moved onwards after taking privileges on a single server. Your responsibility does not disappear because someone else runs the system. The fine landed on the processor, two municipalities and a region are now under supervision in the same case, and as controller you are the one who must show how the supplier was chosen and followed up. That takes concrete contract terms on version control, monitoring and notification deadlines, plus documented checks that the terms are met. We often see processing agreements signed once and never read again. A signed agreement is paper, not a safeguard.

Berigo recommends

• Require your supplier to document which versions of internet facing components are running, and how those versions are checked against known vulnerabilities.
• Ask to see what the monitoring actually alerts on. Alerts that cover performance and availability will not catch an attacker moving between servers.
• Write into the contract when the supplier must notify you of an incident, and ask for a test that shows the notification arrives.
• Review which special categories of personal data the supplier processes for you, and judge whether the security level matches them.
• Rehearse an incident that starts at the supplier, so you know who notifies the data protection authority and who informs the employees.