Sweden’s privacy regulator has fined an HR systems supplier SEK 1.8 million for a breach that touched about 2.2 million people, and kept its inspections of the supplier’s customers open. The supplier answers for how the data was protected. Each customer answers for why the data was there at all, and that second question is the one a board can govern.
What changed
On 22 September 2026 the Swedish Authority for Privacy Protection (IMY) found that Miljödata had breached Article 32(1) of the GDPR, the duty to keep personal data secure, and imposed an administrative fine of SEK 1,800,000. IMY held that the company acted negligently and that the infringement was of high severity. Miljödata supplies web-based HR and work-environment systems used mainly to handle sick leave, rehabilitation and workplace incidents. It has more than 300 customers across Sweden, a large share of them municipalities, regions and other public bodies, and the breach touched about 2.2 million people.
The intrusion began on 20 August 2025. It was discovered three days later, when an alarm about faults in the service fired in IT operations. By then the attacker had moved laterally between servers and started encrypting them without any security monitoring raising an alert. On 2 September the company found indications that data had been extracted, and on 14 September part of it was published on the dark web, 25 days after the intrusion began.
The way in was an SQL injection against a support component of a firewall product, installed on an internet-exposed server about a week earlier. The vendor, a well-known supplier the decision does not name, had delivered an outdated version with a known critical vulnerability, one it had described on its own website more than a year before. Miljödata said it saw no reason to check the version of a costly product from a well-known vendor. IMY held that checking was a basic security measure.
In November 2025 IMY also opened inspections of three of Miljödata’s customers: the City of Gothenburg, Älmhult Municipality and Region Västmanland. Those inspections look at the customers’ own processing in Miljödata’s systems: what types of data were held there and about whom, including former employees, children and people with protected identities. They were still open when the supplier decision was issued.
Why it matters
The regulator has split one incident into two accountability tracks. Miljödata answers for how the data was protected, and its fine is sized to Miljödata: IMY treated the company and its parent as one undertaking with combined 2025 turnover of SEK 58,476,045, set the fine having regard to the severity and the size of the company, and arrived at a figure of roughly three percent of that turnover. Each customer answers, separately, for why the data was in the supplier’s system in the first place.
That division has a consequence that is easy to miss. The supplier’s penalty carries none of the customers’ exposure, and it says nothing about how the customer inspections will end. What those inspections examine is a set of choices the customers made themselves. The services held about 20 data items per person, including personal identity numbers, sick-leave data, rehabilitation documentation and medical certificates. They held data on children. They also held protected personal data, although the starting point had been that such data was not meant to be processed there at all.
Two features of the supplier’s own reasoning sharpen the point. First, Miljödata’s risk assessment judged the likelihood of a cyberattack relatively low, among other reasons because of the company’s limited public profile. That reasoning is sized to the supplier. The data it aggregated across hundreds of customers made it a concentrated target however quiet its public profile, and no single customer’s contract would ever show that aggregate.
Second, the entry point was a case of trust by reputation. Miljödata relied on a well-known vendor instead of checking what it had been sent, and the regulator rejected that as a reason to skip a basic control. Customers apply the same reasoning one level up when a supplier’s standing substitutes for their own scrutiny of what they are sending it.
What changes for management
Management’s most direct lever is a decision it makes and can revisit: what the organisation sends to each supplier, and how long the data stays there. The customer inspections turn on precisely those two things. Records on former employees are the clearest case of data outliving its purpose, and together with data on children and on people with protected identities they are the categories the regulator chose to examine.
This reframes the supplier file. The contract, the security schedule and the supplier’s certifications describe how the data will be protected. None of them records what was actually loaded, by which team, and when it was due for deletion. That inventory has to be built from the organisation’s side, and it tends to be more accurate when built alongside the people who load the data than when read off the contract register.
The case also shows how late a customer may learn what it needs to know. The intrusion was found through a service fault rather than a security alert, and indications of extraction came ten days after discovery. A customer’s own notification duties run on its own clock, yet in practice they depend on how fast the supplier can see and establish what happened.
What changes for the board
Supplier governance usually looks outward at the supplier: its controls, its certifications and, as an earlier Board Lens piece argued, the possibility that a supplier’s regulatory position can shift without any change to the contract. This decision adds the inward half. Alongside whether the supplier is secure, the board now has a question squarely within its own reach: what the organisation put there, and why it was still there.
The board should also update what it treats as harm. Miljödata argued for a reprimand only, saying no controller or data subject had made a concrete claim. IMY, citing the EU Court of Justice, held that loss of control over personal data is itself damage, even without concrete misuse. A board that waits for evidence of misuse before treating a supplier breach as material is applying a test the regulator has set aside.
Finally, the size of the supplier’s fine is no guide to the customer’s position. IMY gave some mitigating weight to Miljödata’s efforts to inform its customers, including individual meetings with several hundred of them. Those efforts helped the supplier. The customers’ inspections remained open regardless.
Questions boards should now ask
- What categories of personal data does each significant supplier hold for us, and does that list match what our own teams actually load?
- Are records on former employees, children or people with protected identities held in any supplier system, and on what basis and for how long?
- Does our supplier risk assessment weigh likelihood by the supplier’s public profile, or by the volume and sensitivity of what it holds across all its customers?
- For suppliers holding sensitive data, do we know whether their monitoring is built to detect intrusion or only to keep the service running?
- When a supplier tells us a component comes from a reputable vendor, what evidence do we ask for that the version in use is current?
- If a supplier holding our data were breached tomorrow, how soon would we know whether data had been extracted, and who would decide our own notification?
- Setting the supplier’s failings aside, how would we explain to a regulator why each category of data was with that supplier?
- Who inside the organisation owns the decision about what data is sent to a supplier and when it is removed?
Practical implications
Three modest steps follow. First, commission a short inventory of the personal data categories held by each significant supplier, built with the people who load the data, and record a retention position for each, starting with former employees, children and protected identities. Second, ask critical suppliers two direct questions: how they confirm the versions of internet-exposed components, and whether their monitoring is aimed at security events or at availability. Treat the answers as governance inputs, not assurance. Third, name a single internal owner for the decision about what is sent to each supplier and when it comes back or is deleted, and have that owner report to the board on a set cycle. Each step settles who decides, on what evidence, and when the decision is revisited.