Sanction RGPD Data Protection Authority of Sweden (Integritetsskyddsmyndigheten) — Sportadmin i Skandinavien AB : 565 k€ (2026)
- Autorité de contrôle
- Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)
- Pays
- Suède
- Entreprise / secteur
- Sportadmin i Skandinavien AB
- Montant de l'amende
- 565 k€
- Date de la décision
- 26 janvier 2026
- Fondement juridique
- Art. 32 (1)
- Manquement
- Mesures techniques et organisationnelles insuffisantes
Résumé des faits
The Swedish DPA has imposed a fine of EUR 565,500 on Sportadmin i Skandinavien AB. The controller suffered a sucessfull cyber attack, resulting in personal and special category data of 2,126,075 individuals, including minors, beeing published in the darknet. The attack happend due to an succesfull SQL injection on one of the controllers websites, which had not been protected against this kind of attack, granting the attacker access to the controllers server, allowing him to exfiltrate said data.
Décision officielle
Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)