Sweden

Sportadmin i Skandinavien AB

565,000 €

GDPR enforcement action by Data Protection Authority of Sweden (Integritetsskyddsmyndigheten) on 2026-01-26.

Rank · Sector

#42

of 597 in Industry and Commerce

Rank · Sweden

#15

of 46

Rank · All fines

#228

of 3,050

Case details

Authority: Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)
Date: 2026-01-26
Controller / Processor: Sportadmin i Skandinavien AB
Sector: Industry and Commerce
Quoted Articles: Art. 32 (1) GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Swedish DPA has imposed a fine of EUR 565,500 on Sportadmin i Skandinavien AB. The controller suffered a sucessfull cyber attack, resulting in personal and special category data of 2,126,075 individuals, including minors, beeing published in the darknet. The attack happend due to an succesfull SQL injection on one of the controllers websites, which had not been protected against this kind of attack, granting the attacker access to the controllers server, allowing him to exfiltrate said data.

Open original source Links to the regulator's original publication or another source.