When the supplier gets fined
Sep 24th, 2026 by Jesper Kråkhede
This week the Swedish data protection authority fined the system supplier that was hit by ransomware in August last year. The attack affected a large share of the country´s municipalities, and sensitive data about employees was published. The fine was 1.8 million kronor, for not having appropriate technical and organisational security measures under the GDPR.
It is worth thinking about what that means, beyond the amount.
For suppliers, it is a clear signal. If you process sensitive data on behalf of others, you are responsible for protecting it, and you will be held accountable when you don´t. The authority looked at concrete things: how software was installed and checked, and whether there was monitoring that would detect an attack in time.
For the customers, it is just as important. Many municipalities thought they had outsourced the problem. They hadn´t. They still had to notify their employees, handle the consequences and explain to their own supervisory authorities what they had done to choose and follow up the supplier.
This is where compliance gets real. Data processing agreements, supplier assessments and security requirements in procurement are often treated as paperwork. This case shows that they aren´t. When something goes wrong, the question is what you actually checked, not what you signed.
So for management: look at the suppliers that hold your most sensitive data. Ask what you know about their security, and how you know it. Ask for evidence, not certificates alone.
The fine was paid by the supplier. The price was paid by everyone.