Miljödata

Miljödata, a Swedish software company handling sick leave and rehabilitation records for municipalities, regions and businesses, was attacked in August 2025. Attackers demanded 1.5 Bitcoin and, when it was not paid, published the stolen data on the dark web under the name Datacarry.

On 22 September 2026 Sweden's data protection authority IMY fined the company SEK 1.8 million, roughly $183,000, for breaching GDPR Article 32. IMY has opened separate investigations into two municipalities and one region that used the systems, so further penalties tied to the same breach may follow.

Personal identity numbers, contact details, and sensitive data covering sick leave, rehabilitation, and student-related incidents in schools.

Every category here is special category data under GDPR. Sick leave and rehabilitation records describe an employee's health to their employer, which is the most sensitive workplace information there is. The school incident reports involve minors. Miljödata's software is used by roughly 80% of Sweden's municipal systems, which is how a single supplier reaches 2.2 million people in a country of about 10 million.

Municipal employees whose health and absence history was in the system, and schoolchildren named in incident reports. Neither group chose the supplier. They were employed by a municipality or enrolled in a school that did.

Published data is a different category of harm from stolen data. When the ransom went unpaid the records were put on the dark web, which means the exposure is permanent and public rather than held by one criminal party. A Swedish personal identity number, like a Danish CPR number, is not reissued.

Specialising in municipal HR and occupational health software is a reasonable business, and buying it rather than building it is the correct decision for a municipality of any size.

IMY's findings name the specific failures: the company did not adequately test newly installed software, and it did not run automated real-time monitoring capable of detecting intrusions or suspicious activity. That second point is the one the regulator treated as an Article 32 violation, and it is a control about noticing rather than preventing.

That an intrusion was underway. IMY's finding is explicit: no automated real-time monitoring capable of detecting intrusions or suspicious activity. The attack succeeded, the data left, and the first confirmation came from the attackers.

The second thing nobody had measured was concentration. A supplier serving 80% of municipal systems holds a share of national health data that no single municipality would ever be permitted to assemble. Each municipality assessed its own vendor relationship. Nobody assessed the aggregate.

The regulator is now investigating the customers as well as the supplier, which is the correct reading. Outsourcing the processing did not outsource the responsibility for knowing what was being processed.

The Datacarry group published the data after a 1.5 Bitcoin demand went unpaid. The attribution is settled and so is the outcome, which makes this one of the few entries in this series with a complete arc from intrusion to regulatory finding.

Thirteen months elapsed between the August 2025 attack and the September 2026 fine. That is the real timeline of a public sector breach, and it is worth remembering when an organisation says an investigation is ongoing.

Monitoring, by the regulator's own account. IMY did not fine Miljödata for being breached. It fined the company for lacking the capability to detect that it was being breached, which is a distinction worth repeating to any board that treats detection as optional.

Second, knowing what the concentration looked like. A supplier reaching 80% of a country's municipalities is a national infrastructure dependency, and that status was visible on the customer list long before it was visible on a dark web leak page.