French software company fined $2 million for cyber failings leading to data breach

France’s data protection regulator CNIL has fined Nexpublica France €1.7 million ($2 million) for poor cybersecurity practices in the wake of a data breach. In November 2022, users of a Nexpublica portal reported they could access documents about third parties, prompting CNIL to investigate and find that Nexpublica’s data security programme was inadequate, according to CNIL.

On 22 December, CNIL levied the fine, which it said was based on the company’s financial capacity, its lack of knowledge of basic security principles, the number of people affected and the sensitivity of the data processed. The report notes that the action follows the regulator’s assessment of the incident and the associated security shortcomings. Read more at The Record, according to CNIL’s press release. The article was posted on 30 December 2025 by Dissent for DataBreaches[.]Net.