Compliance Radar
Who was sanctioned, and for what?
Fines, court rulings and incidents from Europe, North America, Latin America, Asia-Pacific, Middle East and Africa: 2,033 cases from 44 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.
Click a bar to drill down one level.
Where?
by regionAll jurisdictions
What for?
by topicWho?
by company- Google LLC €1.19bn 80 % · 1 case
- SK Telecom Co., Ltd. €83.2m 6 % · 1 case
- Orange SA €50m 3 % · 1 case
- Vodafone GmbH €45m 3 % · 1 case
- Free Mobile SAS und Free SAS €42m 3 % · 1 case
- KT Corporation €32.7m 2 % · 1 case
- Anonymised companies €16.8m 1 % · 10 cases
- TIM S.p.A. €9.52m 1 % · 1 case
- Betreiber elektronischer Kommunikationsnetze und -dienste (in der Mitteilung nicht namentlich genannt) €4.5m 0 % · 1 case
- Advanced Computer Software Group Ltd €3.68m 0 % · 1 case
- 33 more€10.2m
When?
per quarter, by date of decision| Period | Cases | Total |
|---|---|---|
| Q4 2023 | 0 | – |
| Q1 2024 | 0 | – |
| Q2 2024 | 0 | – |
| Q3 2024 | 0 | – |
| Q4 2024 | 0 | – |
| Q1 2025 | 0 | – |
| Q2 2025 | 0 | – |
| Q3 2025 | 0 | – |
| Q4 2025 | 0 | – |
| Q1 2026 | 0 | – |
| Q2 2026 | 0 | – |
| Q3 2026 | 1 | – |
| Q4 2026 | 0 | – |
1 case
19 Aug 2026 KDDI株式会社 (KDDI Corporation)KDDI: data protection authority guidance after leak of 12.2 million email credentials Reprimand or warning
Through a software vulnerability in a mail platform developed by KDDI and provided to several internet service providers, unauthorised parties obtained the credentials (email address and password) of 12,231,954 people; 7,616,173 passwords were stored in plain text, so mailboxes could be read (discovered on 17 June 2026). The authority gave KDDI guidance (shidō) under Art. 147 APPI to improve its technical security measures because access controls against attackers spreading through the system had been inadequate, required a report by 19 October 2026 and also gave such guidance to individual providers responsible for the plain-text storage.
Passwords must never be stored in plain text, and platforms that serve many customers need layered defences against attackers spreading after a breach.
Password security and password reuse
- Authority / court
- Personal Information Protection Commission (PPC, 個人情報保護委員会)
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- Act on the Protection of Personal Information (APPI, 個人情報の保護に関する法律) Art. 147, Art. 146 Abs. 1
- Action
- Reprimand or warning
- Status of proceedings
- unknown
- Sector
- Telecoms, IT and software
- Employees
- 10,000 or more
- Published
- 19 Aug 2026
- PPC – ＫＤＤＩ株式会社及びインターネットサービスプロバイダに対する個人情報の保護に関する法律に基づく行政上の対応並びにメールサービス利用者に対する注意喚起について（令和８年８月19日, PDF） Press release of an authority
- PPC – Pressemitteilung KDDI (19.08.2026) Press release of an authority
Checked against the official source on 4 Oct 2026 · Direct link