Swedish IT Company Data Breach Exposes Personal Details of 1.5 Million Users

Swedish authorities have launched formal investigations into a significant data breach that exposed the personal details of more than 1.5 million individuals linked to Miljödata, an IT company relied on by multiple Swedish municipalities and regional entities. The probe was initiated by the Swedish Data Protection Authority (IMY) after the August attack, which resulted in sensitive data being published on the Darknet.

The Prosecution Authority has confirmed that data belonging to more than 1.5 million private citizens was extracted and published. According to IMY, the investigations will examine compliance with GDPR, with Miljödata, the City of Gothenburg, Älmhult Municipality, and Region Västmanland selected for detailed audits, and other reviews potentially extending to additional parties.

Investigators will focus on technical security deficiencies, data handling practices, and the protections required for high‑risk categories such as protected identity information and children’s data. The breach underlines growing regulatory pressure on Sweden’s organisations to strengthen security, conduct vulnerability assessments, and implement robust incident response protocols.