Sweden's IMY fined Miljödata SEK 1.8 million after ransomware attack exposed 2.2 million individuals

What happened

In August 2024, Miljödata, a Swedish environmental data company, suffered a ransomware attack that compromised personal data of approximately 2.2 million individuals ^[1]. The attackers encrypted production databases and backups, and exfiltrated data before the encryption took effect. On 16 December 2024, Sweden's data protection authority IMY announced a fine of SEK 1.8 million ^[1].

The fine wasn't for losing the data. It was for failing to show that the company had put adequate security in place to begin with.

The breach itself

Ransomware works like a bank robber who photographs the vault before locking it. The attacker gets in, copies what they want, then encrypts everything so you can't use it either. In Miljödata's case, both the live databases and the backups were hit, which meant recovery was harder and the damage wider ^[1].

Think of it like losing your house keys and finding out the thief made a copy before posting them back through the letterbox. The lock still works, but they've already been inside.

What IMY found

IMY's decision focused on Article 32 of the GDPR, which requires appropriate technical and organisational measures to ensure a level of security appropriate to the risk ^[2]. The authority found that Miljödata had failed to meet that standard. Specifically, the company could not demonstrate that it had implemented adequate controls to protect against unauthorised access, modification or loss of personal data ^[1].

The challenge for any organisation in Miljödata's position is this: after an attack, you have to show what you did before it happened. If your security documentation is patchy or your logs have gaps, you're trying to prove a negative.

Why logs and records matter

In an incident like this, logs are the difference between a conversation about what went wrong and a guess. They show who accessed what, when controls were applied and whether anything changed in the lead-up to the breach. Without them, it's your word that the protections were there.

The GDPR doesn't specify which security measures you must use. It says they must be appropriate to the risk. That gives organisations flexibility, but it also means you have to be able to explain your choices and show they were in place. A well-kept log does both.

Reporting deadlines under the Cybersecurity Act

Sweden's Cybersecurity Act, which implements the NIS2 Directive and came into force on 15 January 2026, sets strict timelines for incident reporting ^[3]. Essential and important entities in 18 sectors must report significant incidents in three stages: an early warning within 24 hours of becoming aware of the incident, a full incident notification within 72 hours and a final report within one month.

The 24-hour clock starts when you become aware, not when it suits you. It's like dropping your bank card: the timer begins the moment you notice, not when you get round to calling the bank.

Sealed records as part of your security posture

This is where a digital witness fits. The thing to seal is each log segment as it closes, every few minutes. Sealing takes a fingerprint of the segment, not the data itself, so the logs stay in your systems. If an incident happens and someone later questions whether the logs were edited, anyone you share them with can check that they haven't changed since they were sealed.

What it shows is that each log segment is exactly what was written at the time. What it doesn't do is replace access control, monitoring or backups, and it doesn't prove the logs are complete. But it does make them harder to challenge, because a change would show up even if it were made by someone with administrator rights.

Sealing works through WitniumChain, using the REST API, the SDK or the MCP server. The content never leaves your systems. You get a witness ID back for each segment, and anyone can verify it later by recalculating the fingerprint and comparing. The first 2,000 witnesses a month are free. Read the docs.

How it would work

1. Each log segment is sealed as it closes, every few minutes.
2. The fingerprint, not the log, is sent for sealing.
3. After an incident, auditors or supervisors can check that the segments haven't changed since they were sealed.

What this means for you

If you handle personal data or fall under the Cybersecurity Act, here are three questions worth asking now:

1. Could you show, after an incident, what security measures were in place before it happened?
2. If your logs were questioned, could you prove they haven't been edited?
3. Do you have a documented process for meeting the 24-hour early warning deadline, including how you record the moment you became aware of an incident?

The fine in Miljödata's case was for failing to demonstrate adequate security. The lesson is that documentation and checkable records are part of the security itself, not an afterthought.

What to watch

The Cybersecurity Act's reporting deadlines apply to essential and important entities from 15 January 2026. IMY and other supervisors across the EU are increasingly focused on organisations' ability to show, not just state, that they took appropriate measures. Sealed logs and incident records are one way to make that showing shorter and clearer.