Spain

ECG Médica, S.L.

18,000 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2026-07-15.

Rank · Sector

#122

of 293 in Health Care

Rank · Spain

#372

of 1,133

Rank · All fines

#1,219

of 3,267

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2026-07-15
Controller / Processor: ECG Médica, S.L.
Sector: Health Care
Quoted Articles: Art. 32 GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Spanish DPA has imposed a fine of EUR 18,000 on ECG Médica, S.L. From 23 July 2024, an attacker emailed the controller and threatened to release patient data, sending diagnostic reports directly to patients. The controller notified the breach on 25 July 2024. A final total of 1,352 patients were affected, with at least 25 patient reports published on a leak site. Following an investigation, it was found that, given the sensitivity of the data, the controller had not implemented adequate technical or organisational measures to ensure the security of personal data.

Open original source Links to the regulator's original publication or another source.