Miljödata reportedly fined $183,000 after breach affecting 2.2 million

The regulator cites monitoring and software-check failures

BleepingComputer reports that Sweden’s data privacy regulator, IMY, imposed a $183,000 (SEK 1.8 million) fine on Miljödata over inadequate security measures connected to an August 2025 breach. The report says IMY found insufficient checks of newly installed software and no automated real-time monitoring to detect intrusions or suspicious activity. It says the breach affected 2.2 million people and exposed sensitive information.

Before this reported action, IMY had opened an investigation in November 2025 into the August 2025 cyberattack on Miljödata.

IMY has reportedly moved from investigating the incident to imposing a $183,000 (SEK 1.8 million) GDPR penalty on Miljödata.

The reported penalty marks a regulatory consequence following a breach involving a widely used provider of work-environment and HR management systems. IMY is also reported to be investigating two municipalities and one region in connection with the attack.