Swedish DPA fines IT provider EUR 160,000 after cyberattack exposed personal data

What happened

In August 2025, Miljödata i Karlskrona, a Swedish IT service provider, suffered a cyberattack that exposed large volumes of personal data ^[1]. Some of the data fell into the special categories under GDPR Article 9, which includes health data, biometric data and information about trade union membership ^[2].

On 3 March 2026, the Swedish Data Protection Authority (IMY) announced a fine of approximately EUR 160,000 ^[1]. The authority found that Miljödata had not implemented adequate technical and organisational measures to protect the data, in breach of GDPR Article 32 ^[1][2]. That article requires a level of security appropriate to the risk, taking into account the state of the art and the costs of implementation ^[2].

The case is one of hundreds on the European Data Protection Board's list of national sanctions, but it raises a question that affects everyone responsible for security: when a breach happens, how do you prove what you had in place before it happened?

The evidence problem

IMY does not publish detailed decisions in every case, so the public summary does not explain exactly what Miljödata could not demonstrate ^[1]. What is clear is that the authority found the security measures insufficient.

The difficulty is timing. A log that shows what happened during an attack is valuable. A log that shows the safeguards you had implemented before the attack is harder to produce, because someone might reasonably ask whether it was created or altered after the fact.

Access controls, monitoring and backups are the foundation. They reduce the risk and help you respond when something goes wrong. The evidence question is separate: can you show a supervisor that those controls were in place and functioning before the breach occurred?

This matters under the Swedish Cybersecurity Act as well. That law, which entered into force on 15 January 2026 and implements the NIS2 Directive, requires essential and important entities to have risk management in place and to report significant incidents ^[3]. Early warning must be given within 24 hours, a full incident report within 72 hours and a final report within one month ^[3]. When you report, you are describing what happened and what you did to prevent it. If your logs can be quietly edited by the people who keep them, an auditor or a court may be less inclined to take them at face value.

What this means for you

If you are responsible for IT security or data protection, three questions are worth asking now:

1. Could you show an auditor or a supervisor that your access controls and monitoring were in place and working before an incident occurred?
2. Are your logs protected against tampering, deletion and unauthorised access, and can you prove that protection?
3. If you had to report an incident under the Cybersecurity Act, would your records support the timeline you give?

The law does not prescribe a single technology. GDPR Article 32 speaks of the state of the art and the nature of the data ^[2]. DORA's technical standard on ICT risk management, which applies to financial entities, requires logs to be protected against tampering, deletion and unauthorised access ^[4]. The Swedish Cybersecurity Act requires risk management and incident reporting but does not specify how logs must be kept ^[3].

What all of these rules have in common is that they expect you to be able to show what you did. That is where a digital witness comes in. A sealed fingerprint of a log, a policy or a configuration file gives you a record that can be checked later, without anyone having to trust that it was not altered after the fact.

What to watch

IMY publishes summaries of some of its decisions on its website and reports them to the European Data Protection Board. The full decision in the Miljödata case may be available in Swedish through IMY's public register.

Under the Cybersecurity Act, the first annual reports from essential and important entities will be due in early 2027. The Swedish Civil Contingencies Agency (MSB) supervises most sectors, and its guidance on incident reporting and risk management will shape how organisations demonstrate compliance.

Sources

1. European Data Protection Board, "Swedish DPA fines Miljödata i Karlskrona approximately EUR 160,000 for insufficient technical and organisational security measures", 3 March 2026, https://www.edpb.europa.eu/news/swedish-dpa-fines-miljodata-i-karlskrona-approximately-eur-160-000-for-insufficient-technical_en

2. Regulation (EU) 2016/679 (General Data Protection Regulation), Articles 9 and 32, https://eur-lex.europa.eu/eli/reg/2016/679/oj

3. Swedish Cybersecurity Act (Cybersäkerhetslagen, 2025:1506), implementing Directive (EU) 2022/2555 (NIS2), entered into force 15 January 2026, https://data.riksdagen.se/dokument/sfs-2025-1506.html

4. Commission Delegated Regulation (EU) 2024/1774, Article 12(2)(d), on ICT risk management under DORA, https://eur-lex.europa.eu/eli/reg_del/2024/1774/oj