Norway

Østre Toten municipality

412,000 €

GDPR enforcement action by Norwegian Supervisory Authority (Datatilsynet) on 2021-10-18.

Rank · Sector

#17

of 357 in Public Sector and Education

Rank · Norway

of 53

Rank · All fines

#262

of 3,050

Case details

Authority: Norwegian Supervisory Authority (Datatilsynet)
Date: 2021-10-18
Controller / Processor: Østre Toten municipality
Sector: Public Sector and Education
Quoted Articles: Art. 5 (1) f) GDPR, Art. 32 GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Norwegian DPA has fined Østre Toten municipality EUR 412,000. The municipality suffered a cyberattack in January 2021, as a result of which the municipality's data was encrypted as well as backups were deleted. A larger amount of data was later published on the dark web.

Approximately 30,000 documents were affected by the attack. The documents contained, among other things, information on ethnic origin, political opinion, religious beliefs, union memberships, sexual orientation, health status, as well as banking data of the municipality's residents and employees.

The DPA's investigation revealed that the municipality had fundamental deficiencies in the security of personal data and related internal controls.Among other things, the municipality had not used two-factor authentication when logging into systems, and lacked appropriate backup systems.

Open original source Links to the regulator's original publication or another source.