Miljödata i Karlskrona AB

Summary

The Swedish DPA has imposed a fine of EUR 160,050 on Miljödata i Karlskrona AB. Miljödata offers web services for managing sick leave, rehabilitation and incidents. Its customers include around 300 public and private institutions in Sweden. In a cyberattack in 2025, the attacker gained access to a large volume of personal data, which they subsequently published on the Darknet. This data contained personal identity numbers, contact details, sensitive information on sick leave and rehabilitation, as well as information on incidents involving students at schools. In total, the attack and publication affected the personal data of about 2.2 million data subjects. The Swedish DPA found that the processor had not implemented adequate measures to ensure information security, especially given the sensitive nature of the data being processed. In particular, it failed to conduct adequate security audits and lacked the tools to monitor relevant threats.