Miljödata, a Swedish software company serving 80% of Sweden's municipal systems, experienced a cyberattack in August 2025 that disrupted IT services and exposed sensitive personal data of 2.2 million people. The threat actor demanded 1.5 Bitcoin ransom and leaked the data under the alias 'Datacarry'. IMY's investigation found Miljödata failed to maintain adequate technical and organizational security, specifically lacking sufficient checks on newly installed software and automated real-time intrusion detection. This constituted a violation of GDPR Article 32(1), resulting in a $183,000 fine. Additional investigations into affected municipalities and regions are ongoing.

The breach exposed sensitive personal data including identity numbers, contact information, health-related data, and school incident records involving minors. The data leak affected 2.2 million individuals and disrupted IT services in over 200 regions. The exposure of such data poses significant privacy risks and potential harm to affected individuals. The incident also led to regulatory penalties under GDPR for Miljödata and may result in further fines for related entities.

The vendor was fined for failing to implement adequate security measures, specifically insufficient software installation checks and lack of automated real-time monitoring. Organizations should ensure rigorous validation of software installations and deploy automated, real-time intrusion detection systems to comply with GDPR Article 32(1). Since this is a past incident with regulatory action taken, no urgent remediation is indicated beyond adherence to GDPR security requirements. Ongoing investigations may inform further mitigation steps.