22 Sep 2026 OTC Link LLCOTC Link: 575,000 USD – security policies never completed despite examination findings USACritical infrastructure €501,614

From 2016 to 2025, the operator of the OTC Link ATS trading system lacked complete policies on systems security, access control and vulnerability management as required under Regulation SCI. Although the examiners of the U.S. Securities and Exchange Commission (SEC) had criticised the gaps in several examinations, drafts remained unfinished; the SEC issued a censure and imposed 575,000 USD.

What organisations can take from it

Track supervisory examination findings with a deadline and a responsible person – points that remain open repeatedly become expensive.

Authority / court: U.S. Securities and Exchange Commission (SEC)
Area of law: Information security and cyber · Critical infrastructure
Legal basis: Regulation SCI, Rule 1001(a)(1)–(3)
Action: Fine
Status of proceedings: final
Sector: Financial services and insurance
Repeat case: yes

Original amount 575,000 USD, converted at the ECB reference rate of 22 Sep 2026.

Sources

SEC Censures OTC Link LLC for Repeated Compliance Failures Related to Regulation SCI (22.09.2026) Press release of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

5 Aug 2026 Order Express, Inc.NYDFS: $250,000 against money transmitter Order Express over cyber deficiencies USA, NYSecurity measures and risk management €216,375

The licensed money transmitter had no adequate policies for system updates and insufficient risk assessments under New York's cybersecurity regulation, as found by the New York State Department of Financial Services (NYDFS). The company has already remedied the deficiencies.

What organisations can take from it

Even small financial service providers must keep documented patch policies and regular risk assessments.

Authority / court: New York State Department of Financial Services (NYDFS)
Area of law: Information security and cyber · Security measures and risk management
Legal basis: 23 NYCRR Part 500 (Cybersecurity Regulation)
Action: Fine
Status of proceedings: final
Sector: Financial services and insurance
Mitigating circumstances: Because of its low turnover, the company was exempt from many Part 500 obligations; deficiencies already remedied.
Published: 5 Aug 2026

Original amount 250,000 USD, converted at the ECB reference rate of 5 Aug 2026.

Sources

New York State Department of Financial Services Secures Cybersecurity Settlement with Order Express, Inc. Press release of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

28 Jul 2026 Luk Fook Securities (HK) LimitedLuk Fook Securities: HKD 2.1m fine for weak cybersecurity ahead of ransomware attack Hong KongSecurity measures and risk management €235,595

Luk Fook Securities (HK) was publicly reprimanded and fined 2,100,000 HKD because inadequate cybersecurity controls might have contributed to a ransomware attack on 19 September 2022 hitting numerous core servers and to full recovery taking until 7 October 2022; during that time clients could not trade via the app or internet platform. Findings included missing firewall protection, outdated operating systems and antivirus software, weak access and password controls with credentials stored unencrypted, insufficient controls over remote access and external devices, inadequate data backup and a last security training session in 2018.

What organisations can take from it

Basic cyber hygiene – patching, access and password controls, backups and regular staff training – is a regulatory obligation for financial firms.

Relevance to training and awareness

Ransomware defence, password security and security awareness training

Missing or inadequate training played a role in the decision.

Authority / court: Securities and Futures Commission (SFC)
Area of law: Information security and cyber · Security measures and risk management
Legal basis: s. 194 SFO (Cap. 571); Code of Conduct GP 2, GP 3, GP 7, paras. 12.1, 18.5 und Schedule 7; Guidelines for Reducing and Mitigating Hacking Risks Associated with Internet Trading
Action: Fine
Status of proceedings: final
Sector: Financial services and insurance
Repeat case: no
Mitigating circumstances: Root-cause review with an independent reviewer, strengthened controls, no evidence of client loss, cooperation, clean disciplinary record.
Published: 28 Jul 2026

Original amount 2,100,000 HKD, converted at the ECB reference rate of 28 Jul 2026.

Sources

SFC press release 26PR118: SFC reprimands and fines Luk Fook Securities (HK) Limited $2.1 million for inadequate cybersecurity control (28.07.2026) Press release of an authority
SFC Statement of Disciplinary Action zu 26PR118 Decision of an authority

Checked against the official source on 3 Oct 2026 · Direct link

Report an error

29 Apr 2026 Delta Dental Insurance Company und Delta Dental of New York, Inc.NYDFS: $2.25 million against Delta Dental after MOVEit attack and late notification USA, NYSecurity measures and risk management €1.92m

In 2023, attackers exploited a zero-day vulnerability in MOVEit Transfer to steal files containing social security, driving licence, account and health data. The New York State Department of Financial Services (NYDFS) criticised inadequate retention settings, policies and controls as well as the late notification of the cybersecurity incidents to the supervisory authority.

What organisations can take from it

Keep data in transfer tools only for as long as necessary – and report security incidents to the supervisory authority on time.

Authority / court: New York State Department of Financial Services (NYDFS)
Area of law: Information security and cyber · Security measures and risk management
Legal basis: 23 NYCRR Part 500 (Cybersecurity Regulation)
Action: Fine
Status of proceedings: final
Sector: Financial services and insurance
Culpability: negligent
Published: 30 Apr 2026

Original amount 2,250,000 USD, converted at the ECB reference rate of 29 Apr 2026.

Sources

DFS Secures $2.25 Million Cybersecurity Settlement with Delta Dental Press release of an authority
Consent Order to Delta Dental 2026 Decision of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

7 Apr 2026 Wspólnota Mieszkaniowa K. (Wohnungseigentümergemeinschaft, im Bescheid pseudonymisiert)Homeowners’ association: 4,852 PLN – misdirected statement not notified PolandIncident reporting obligations €1,135

Acting as processor, the property management company sent an owner’s statement of service charges to an unauthorised person. The association considered notification unnecessary because only ‘ordinary’ data of one member were affected, and maintained this position in the proceedings; the UODO (Poland’s data protection authority) imposed 4,852 PLN.

What organisations can take from it

Small controllers must also assess and notify data breaches by their service providers – ‘only one data subject’ is no ground for exemption.

Relevance to training and awareness

Recognising misdirected mail as a data breach – including at service providers

Authority / court: Prezes Urzędu Ochrony Danych Osobowych (UODO)
Area of law: Information security and cyber · Incident reporting obligations
Legal basis: Art. 33 Abs. 1 DSGVO
Action: Fine
Status of proceedings: final
Sector: Construction and real estate

Original amount 4,852 PLN, converted at the ECB reference rate of 7 Apr 2026.

Sources

UODO, Decyzja DKN.5131.16.2025 vom 07.04.2026 (rechtskräftig) Decision of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

9 Feb 2026 FIIG Securities LimitedFIIG Securities: 2.5 million AUD for inadequate cyber security ahead of data theft AustraliaSecurity measures and risk management €1.48m

The Federal Court of Australia, on application by the Australian Securities and Investments Commission (ASIC, Australia's corporate, markets and financial services regulator), imposed a penalty of 2.5 million AUD on the fixed-income specialist because between March 2019 and June 2023 it lacked adequate cyber security measures, resources and risk management systems – among other things, there was no multi-factor authentication for remote access, no regular penetration testing and no mandatory security awareness training. In a 2023 attack around 385 GB of confidential data were stolen and some 18,000 clients were notified; the court also ordered a compliance programme with an independent expert.

What organisations can take from it

For licensed financial services firms, cyber security is part of their licence obligations: basic measures such as MFA, patching, monitoring, training and a tested incident response plan must be funded and actually implemented.

Relevance to training and awareness

Cyber security basics: multi-factor authentication, patch management, security awareness training, tested incident response plan

Missing or inadequate training played a role in the decision.

Authority / court: Federal Court of Australia (auf Antrag der Australian Securities and Investments Commission, ASIC)
Area of law: Information security and cyber · Security measures and risk management
Legal basis: Corporations Act 2001 (Cth) s 912A(1)(a), (d) und (h) i. V. m. s 912A(5A)
Action: Fine
Status of proceedings: unknown
Sector: Financial services and insurance
Repeat case: no
Mitigating circumstances: Full cooperation, admissions and an agreed statement of facts; no previous contraventions; the known financial losses (remediation costs of around 1.5 million AUD) were largely borne by the company itself.
Published: 9 Feb 2026

Original amount 2,500,000 AUD, converted at the ECB reference rate of 9 Feb 2026.

Sources

Federal Court of Australia – ASIC v FIIG Securities Limited [2026] FCA 92 (Order 09.02.2026, Gründe 13.02.2026), PDF bei ASIC Court decision
ASIC 26-021MR – ASIC action sees FIIG Securities ordered to pay $2.5 million over cyber security failures (09.02.2026) Press release of an authority

Checked against the official source on 3 Oct 2026 · Direct link

Report an error

11 Dec 2025 Singapore Telecommunications Limited (Singtel)IMDA: SGD 1m against Singtel after hours-long fixed-line voice outage SingaporeCritical infrastructure €660,197

On 8 October 2024 Singtel's fixed-line voice service failed for more than four hours for around 500,000 residential and corporate users; customer service lines of government agencies, healthcare organisations and banks as well as emergency call services were also affected. The cause was that the virtualised firewalls of the voice system and of a monitoring system shared the same hardware, so that an overload of the insufficiently filtered monitoring system also disrupted the voice system and the automatic failover did not work cleanly; according to the investigation, there was no cyber-attack. The Infocomm Media Development Authority (IMDA, Singapore's telecoms and media regulator) imposed a penalty of SGD 1 million under the Telecommunications Act because the incident had been within Singtel's control to prevent.

What organisations can take from it

Critical services need separated components and reliably tested failover mechanisms – shared hardware can turn a fault in an ancillary system into an outage of the core service.

Authority / court: Infocomm Media Development Authority (IMDA)
Area of law: Information security and cyber · Critical infrastructure
Legal basis: Telecommunications Act
Action: Fine
Status of proceedings: unknown
Sector: Telecoms, IT and software
Employees: 10,000 or more
Published: 11 Dec 2025

Original amount 1,000,000 SGD, converted at the ECB reference rate of 11 Dec 2025.

Sources

IMDA: IMDA Imposes Financial Penalty on Singtel for Fixed Voice Disruption (11.12.2025) Press release of an authority

Checked against the official source on 4 Oct 2026 · Direct link

Report an error

1 Dec 2025 One New Zealand Group Limited (One NZ)One NZ: 1.1 million NZD for breaches of the 111 emergency calling code New ZealandCritical infrastructure €543,022

Following proceedings brought by the Commerce Commission (New Zealand's competition and consumer regulator), the High Court ordered One New Zealand Group Limited to pay a pecuniary penalty of 1,100,000 NZD; in addition, the company is paying 100,000 NZD towards the authority's costs, which is not included in the amount. One NZ admitted ten breaches of the 111 Contact Code between 2021 and 2023 concerning information duties, record-keeping and regular contact with customers. The Code is intended to ensure that vulnerable customers whose landline does not work in a power cut receive another way of calling 111 at no cost.

What organisations can take from it

Providers moving customers from copper to new landline technology must actively follow up and fully document vulnerable customers' ability to make emergency calls during power cuts.

Relevance to training and awareness

Duties to vulnerable customers regarding emergency calls during power cuts: inform, follow up, document

Authority / court: High Court of New Zealand (Verfahren der Commerce Commission)
Area of law: Information security and cyber · Critical infrastructure
Legal basis: Telecommunications Act 2001 (Neuseeland), s 156B; 111 Contact Code
Action: Fine
Status of proceedings: unknown
Sector: Telecoms, IT and software
Mitigating circumstances: According to the Commerce Commission, One NZ remedied the breaches as soon as it recognised their scale and cooperated fully with the investigation; the breaches were admitted.
Published: 1 Dec 2025

Original amount 1,100,000 NZD, converted at the ECB reference rate of 1 Dec 2025.

Sources

Commerce Commission – One NZ ordered to pay $1.1 million for breaching 111 obligations (01.12.2025) Press release of an authority
Commerce Commission, Case register – One New Zealand Group Limited (PRJ0047020) Enforcement database of an authority

Checked against the official source on 3 Oct 2026 · Direct link

Report an error

23 Oct 2025 Komornik Sądowy przy Sądzie Rejonowym w S. (Gerichtsvollzieherkanzlei, im Bescheid pseudonymisiert)Bailiff: 20,900 PLN – documents with PESEL number misdirected, not notified PolandIncident reporting obligations €4,938

In October 2023, an uninvolved person received a debtor’s enforcement documents containing name, address, date of birth, PESEL number, amount of the claim and employer. The bailiff’s office neither notified the supervisory authority nor informed the data subject; the UODO (Poland’s data protection authority) imposed 7,700 PLN for the failure to notify and 13,200 PLN for the failure to inform the data subject, and ordered the data subject to be informed within three days.

What organisations can take from it

Where identification numbers such as the PESEL number are disclosed, a high risk can almost always be assumed – notification of the authority and of the data subject is then mandatory.

Relevance to training and awareness

Checking postal mailings; notifying data breaches involving identification numbers

Authority / court: Prezes Urzędu Ochrony Danych Osobowych (UODO)
Area of law: Information security and cyber · Incident reporting obligations
Legal basis: Art. 33 Abs. 1, Art. 34 Abs. 1 und 2 DSGVO
Action: Fine
Status of proceedings: unknown
Sector: Public sector

Original amount 20,900 PLN, converted at the ECB reference rate of 23 Oct 2025.

Sources

UODO, Decyzja DKN.5131.17.2024 vom 23.10.2025 (nicht rechtskräftig) Decision of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

17 Oct 2025 Odido Netherlands B.V.Netherlands: 1.52 million EUR against Odido – interception system without security plan and staff screening NetherlandsCritical infrastructure €1.52m

In inspections in 2021/22, the RDI (Rijksinspectie Digitale Infrastructuur, the Dutch Authority for Digital Infrastructure) found that the mobile operator had no mandatory security plan for its system for lawful interception of telecommunications, that employees with access had not been adequately screened (missing job descriptions, confidentiality declarations, certificates of conduct), that unauthorised persons had access to interception data and that suppliers could access the system digitally. The RDI imposed 1,518,750 EUR; Odido has since renewed the system.

What organisations can take from it

Treat the security plan, staff screening and strictly limited supplier access for highly sensitive systems as the core of the obligation, not a formality.

Relevance to training and awareness

Access rights, staff screening and supplier access for sensitive systems

Authority / court: Rijksinspectie Digitale Infrastructuur (RDI)
Area of law: Information security and cyber · Critical infrastructure
Legal basis: Telecommunicatiewet Art. 15.4; Besluit beveiliging gegevens telecommunicatie (Bbgt) Art. 2, 3, 4
Action: Fine
Status of proceedings: unknown
Sector: Telecoms, IT and software
Mitigating circumstances: System renewed, risk of unauthorised access eliminated.
Published: 17 Oct 2025

Sources

RDI legt Odido boete op van ruim 1,5 miljoen vanwege onvoldoende beveiligd aftapsysteem Press release of an authority
Beschikking tot oplegging bestuurlijke boete Odido (Publieksversie) Decision of an authority

Checked against the official source on 28 Sep 2026 · Direct link

Report an error

14 Oct 2025 Farmers Insurance ExchangeNYDFS: $2.775 million against Farmers over unprotected online quoting tools USA, NYSecurity measures and risk management €2.4m

Attackers harvested driving licence numbers and dates of birth via inadequately secured online quoting tools and agent portals. According to the New York State Department of Financial Services (NYDFS), Farmers infringed the cybersecurity regulation and did not report the incident in time; the penalty is part of a package totalling $19 million against eight motor insurers.

What organisations can take from it

Automatically pre-filled forms containing customer data are a point of entry – scrutinise public-facing applications for the data they disclose.

Authority / court: New York State Department of Financial Services (NYDFS)
Area of law: Information security and cyber · Security measures and risk management
Legal basis: 23 NYCRR Part 500 (Cybersecurity Regulation)
Action: Fine
Status of proceedings: final
Sector: Financial services and insurance
Culpability: negligent
Published: 14 Oct 2025

Original amount 2,775,000 USD, converted at the ECB reference rate of 14 Oct 2025.

Sources

DFS Secures More than $19 Million from Auto Insurance Companies over Data Breaches Press release of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

14 Oct 2025 Infinity Insurance CompanyInfinity Insurance: 2.25 million USD – data leak via quoting tool reported too late USA, NYIncident reporting obligations €1.95m

Attackers extracted driver’s licence numbers in plain text via the motor insurer’s instant quote applications. Infinity discovered the anomalies on 9 February 2021 but only reported the cybersecurity event to the New York State Department of Financial Services (NYDFS) on 14 April 2021; the supervisor also criticised the lack of MFA and insecure development practices.

What organisations can take from it

Misuse of publicly accessible customer applications is also a reportable incident – warnings from the supervisor should trigger an immediate reporting assessment.

Authority / court: New York State Department of Financial Services (NYDFS)
Area of law: Information security and cyber · Incident reporting obligations
Legal basis: 23 NYCRR § 500.17(a), § 500.12(a) u. a.
Action: Fine
Status of proceedings: final
Sector: Financial services and insurance
Culpability: negligent

Original amount 2,250,000 USD, converted at the ECB reference rate of 14 Oct 2025.

Sources

NYDFS Consent Order to Infinity Insurance Company (14.10.2025) Decision of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

22 Sep 2025 Nova Ljubljanska banka d. d.NLB: reprimand because PSD2 interface exposed 57 account numbers SloveniaSecurity measures and risk management Reprimand or warning

After an update of the PSD2 interface for third-party providers in July 2023, the confidentiality of 57 IBAN accounts of bank customers was not ensured. The banking supervisor, Banka Slovenije (Bank of Slovenia), issued a reprimand to the bank for breaching the obligation to protect confidential data (final).

What organisations can take from it

Every change to customer interfaces requires testing for data leakage before go-live.

Relevance to training and awareness

Security testing for software releases of interfaces

Authority / court: Banka Slovenije
Area of law: Information security and cyber · Security measures and risk management
Legal basis: Art. 146, Art. 396 Abs. 1 Nr. 18 ZBan-3 (slowenisches Bankengesetz)
Action: Reprimand or warning
Status of proceedings: final
Sector: Financial services and insurance
Liability of senior managers: Measures against individuals are not reported here.

Sources

Banka Slovenije, Veröffentlichung der Sanktion gegen Nova Ljubljanska banka d. d. (Entscheidung 2025) Decision of an authority
Banka Slovenije – Informacije o izrečenih ukrepih Enforcement database of an authority

Checked against the official source on 28 Sep 2026 · Version 3 · Direct link

Report an error

4 Sep 2025 A*** GmbH (Werbeagentur, im Bescheid pseudonymisiert)Austrian advertising agency: 870 EUR – alert about security gap dismissed as spam AustriaIncident reporting obligations €870

Customer data (including names, e-mail addresses, dates of birth, telephone numbers) could be retrieved via an unprotected development server of the advertising agency. An employee took the first alert from an external party in January 2025 to be spam; only a second alert in February reached management, which closed the gap but only notified the incident on 2 May 2025 after being requested to do so by the Datenschutzbehörde (Austrian Data Protection Authority, DSB). The authority attributed the employee’s conduct to the company.

What organisations can take from it

External alerts about security gaps need a clear intake channel – what ends up in spam still counts as known.

Relevance to training and awareness

Recognising and escalating alerts about security gaps

Missing or inadequate training played a role in the decision.

Authority / court: Datenschutzbehörde (DSB)
Area of law: Information security and cyber · Incident reporting obligations
Legal basis: Art. 33 Abs. 1 iVm Art. 83 Abs. 4 lit. a DSGVO
Action: Fine
Status of proceedings: final
Sector: Media and online platforms
Culpability: negligent
Mitigating circumstances: No previous infringements and cooperation in the proceedings; gap closed immediately after the second alert, employees trained subsequently.

Sources

DSB, Straferkenntnis GZ 2025-0.699.550 vom 04.09.2025 (RIS) Decision of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

14 Aug 2025 Healthplex, Inc.Healthplex: 2 million USD – phishing incident not reported to supervisor for months USA, NYIncident reporting obligations €1.71m

An employee of the dental insurance service provider disclosed his login credentials via a phishing e-mail; the mailbox containing over 100,000 e-mails with health and social security data was accessible. Healthplex had known about the incident since November 2021 but only reported it to the New York State Department of Financial Services (NYDFS) in April 2022 instead of within 72 hours; in addition, there was no MFA for web access and no data retention and deletion policy.

What organisations can take from it

Security incidents require a fixed reporting process with deadline control – the 72-hour clock starts when the incident is identified, not when forensics is completed.

Relevance to training and awareness

Recognising phishing; reporting channels for security incidents

Authority / court: New York State Department of Financial Services (NYDFS)
Area of law: Information security and cyber · Incident reporting obligations
Legal basis: 23 NYCRR § 500.17(a), § 500.12(b), § 500.13, § 500.17(b)
Action: Fine
Status of proceedings: final
Sector: Financial services and insurance
Culpability: negligent

Original amount 2,000,000 USD, converted at the ECB reference rate of 14 Aug 2025.

Sources

NYDFS Consent Order to Healthplex, Inc. (14.08.2025) Decision of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

10 Jul 2025 Poste Vita S.p.A.Poste Vita: 80,000 EUR – data breach notified only four months after customer’s alert ItalyIncident reporting obligations €80,000

A fraudster impersonated a customer by e-mail and, between 2021 and 2023, obtained information and documents on three policies from the life insurer’s case handlers without his identity being verified. Although the customer alerted the company to the false e-mail address in September 2024, Poste Vita only notified the breach to the supervisory authority in January 2025.

What organisations can take from it

Customer alerts about possible data leaks must go into the incident assessment immediately – not only after internal checks are completed.

Relevance to training and awareness

Identity verification for customer requests by e-mail (social engineering)

Authority / court: Garante per la protezione dei dati personali
Area of law: Information security and cyber · Incident reporting obligations
Legal basis: Art. 5 Abs. 1 lit. a und f, Art. 33 Abs. 1 DSGVO
Action: Fine
Status of proceedings: unknown
Sector: Financial services and insurance
Culpability: negligent
Mitigating circumstances: Immediate blocking of further communication, internal investigation, criminal complaint and stricter identity verification.

Sources

Garante privacy, Provvedimento del 10 luglio 2025 [10154110] Decision of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

3 Jul 2025 Telenor Norge ASTelenor Norge: 50 million NOK after four disruptions to emergency numbers in autumn 2024 NorwayCritical infrastructure €4.21m

The Nasjonal kommunikasjonsmyndighet (Nkom, Norwegian Communications Authority) imposed an administrative penalty (overtredelsesgebyr) of 50,000,000 NOK on Telenor Norge because, on four occasions in autumn 2024 (29 August, 16 September, 17/18 October, 13 November), emergency calls over its network failed entirely or intermittently or were misrouted. The inspection found 22 breaches of ekomloven (Electronic Communications Act), sikkerhetsloven (National Security Act) and several regulations, including inadequate risk assessments, planned work not carried out securely, insufficient redundancy, inadequate auditing of a subcontractor and late notification of the authority. In its final decision Nkom maintained the amount announced in February 2025; the deadline for an administrative appeal ran until 8 September 2025.

What organisations can take from it

Operators that carry emergency call services must safeguard planned network changes with a risk analysis and working redundancy, audit their suppliers and report disruptions on time.

Relevance to training and awareness

Planned work on critical networks: risk analysis, a working fallback and notifying the regulator within 30 minutes

Authority / court: Nasjonal kommunikasjonsmyndighet (Nkom)
Area of law: Information security and cyber · Critical infrastructure
Legal basis: ekomloven (lov 4. juli 2003 nr. 83), sikkerhetsloven (lov 1. juni 2018 nr. 24), ekomforskriften, nummerforskriften, klassifiseringsforskriften, virksomhetssikkerhetsforskriften
Action: Fine
Status of proceedings: unknown
Sector: Telecoms, IT and software
Employees: 1,000 to 9,999
Published: 3 Jul 2025

Original amount 50,000,000 NOK, converted at the ECB reference rate of 3 Jul 2025.

Sources

Nkom – Opprettholder millionbot mot Telenor (03.07.2025) Press release of an authority
Nkom – Tilsynsrapporten mot Telenor er klar: Varsler bot på 50 millioner kroner (27.02.2025) Press release of an authority
Nkom – Tilsynsrapport Telenor, offentlig sammendrag av sikkerhetsgradert tilsynsrapport (foreløpig), 27.02.2025 Decision of an authority
Brønnøysundregistrene, Enhetsregisteret – Telenor Norge AS (org.nr. 976967631), antall ansatte Official register or notice

Checked against the official source on 28 Sep 2026 · Direct link

Report an error

23 May 2025 S-Pankki OyjS-Pankki: EUR 7.67m and public warning over faulty banking software FinlandSecurity measures and risk management €7.67m

The Finanssivalvonta (FIN-FSA, Finnish Financial Supervisory Authority) imposed a joint penalty payment of 7,670,000 EUR on S-Pankki Oyj for failings in operational risk management and additionally issued a public warning. A programming error that was live in a bank system from 20 April to 5 August 2022 had not been adequately tested beforehand; the bank lacked a sufficiently secure system and effective incident management and was insufficiently prepared for outsourcing risks. The warning concerns the failure to apply the required strong customer authentication and payments executed without the payers' consent from 6 May to 5 August 2022; earlier penalty payments imposed on the bank by the supervisor (2019 and 2021) increased the amount. The decision is not final.

What organisations can take from it

Changes to authentication and payment processing need documented testing before going live – even when a service provider develops the software.

Relevance to training and awareness

Testing and change management for security-critical banking software

Authority / court: Finanssivalvonta (FIN-FSA)
Area of law: Information security and cyber · Security measures and risk management
Legal basis: Luottolaitostoiminnasta annettu laki 9 luku 16 § (1, 2 und 4 mom.) mit MOK 8/2014; FivaL 40 §, 41 §, 41 b §; öffentliche Verwarnung nach FivaL 39 § wegen Maksupalvelulaki 85 c § 1 mom. und 38 § 1 mom.
Action: Fine
Status of proceedings: under appeal
Sector: Financial services and insurance
Repeat case: yes
Mitigating circumstances: Measures to prevent recurrence and cooperation with the supervisor in the investigation reduced the amount.
Published: 23 May 2025

Sources

Finanssivalvonta: S-Pankki Oyj:lle 7 670 000 euron yhteinen seuraamusmaksu ja julkinen varoitus (23./26.05.2025) Press release of an authority
Finanssivalvonta: Toimituskirja johtokunnan päätöksestä 23.5.2025, FIVA/2024/1181 Decision of an authority
Finanssivalvonta: Finanssivalvonnan päätökset (Lainvoimaisuus: S-Pankki hat beim Verwaltungsgericht Helsinki Beschwerde eingelegt) Enforcement database of an authority

Checked against the official source on 28 Sep 2026 · Direct link

Report an error

21 May 2025 GoDaddy Inc.FTC: GoDaddy must set up an information security programme after hosting security gaps USASecurity measures and risk management Order

According to the Federal Trade Commission (FTC, the US consumer protection authority), the web host did not use multi-factor authentication for its hosting services, monitored security threats inadequately and did not secure connections to customer data, yet advertised “award-winning security”. The final order prohibits false statements about security and requires a comprehensive information security programme and regular reviews by independent assessors.

What organisations can take from it

Be able to prove basics such as MFA and threat monitoring before advertising security – otherwise the advertising promise itself becomes the violation.

Relevance to training and awareness

MFA, monitoring and honest security promises

Authority / court: Federal Trade Commission (FTC)
Area of law: Information security and cyber · Security measures and risk management
Legal basis: Section 5 FTC Act
Action: Order
Status of proceedings: final
Sector: Telecoms, IT and software
Published: 21 May 2025

Sources

FTC Finalizes Order with GoDaddy over Data Security Failures Press release of an authority
FTC Takes Action Against GoDaddy for Alleged Lax Data Security for Its Website Hosting Services Press release of an authority

Checked against the official source on 28 Sep 2026 · Direct link

Report an error

20 Mar 2025 The London Metal Exchange (LME)London Metal Exchange: 9.2 million GBP – controls and escalation failed in nickel turmoil United KingdomCritical infrastructure €11m

When the nickel price rose to over 100,000 USD within just over an hour on 8 March 2022, only junior staff were on duty during Asian trading hours, and they had not been trained to recognise a disorderly market; they did not escalate and even switched off price bands. The Financial Conduct Authority (FCA) imposed a fine on the recognised investment exchange for the first time: 9.2 million GBP after a 30% discount.

What organisations can take from it

Critical infrastructure needs trained staff around the clock and clear escalation paths – including at night and at off-peak times.

Relevance to training and awareness

Escalation of unusual market conditions; training of shift staff

Missing or inadequate training played a role in the decision.

Authority / court: Financial Conduct Authority (FCA)
Area of law: Information security and cyber · Critical infrastructure
Legal basis: FCA REC 2.5.1 (Recognition Requirements); Art. 18 RTS 7 (MiFID II)
Action: Fine
Status of proceedings: final
Sector: Financial services and insurance
Mitigating circumstances: Early settlement (30% discount); improvements since March 2022.

Original amount 9,200,000 GBP, converted at the ECB reference rate of 20 Mar 2025.

Sources

FCA: First FCA enforcement action and fine against Recognised Investment Exchange (20.03.2025) Press release of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

24 Jan 2025 Fantasia Trading LLC, Power Mobile Life LLC und Smart Innovation, LLC (Vertrieb der Marke eufy)eufy cameras: 450,000 USD in New York over unencrypted video streams USA, NYSecurity measures and risk management Fine

The New York Attorney General's office concluded an Assurance of Discontinuance with three US distribution companies of the eufy home security brand. Contrary to advertising promising privacy and end-to-end encryption, the cameras' video transmissions were in part not end-to-end encrypted and in part not encrypted at all, a live video stream could in some cases be accessed without authentication via the relevant URL, and testing processes that could have detected these vulnerabilities were lacking. The companies allegedly pay 450,000 USD in penalties and costs and must regularly substantiate that the manufacturer maintains an information security programme, secure software development, vulnerability management with penetration testing and encryption of the videos.

What organisations can take from it

A company that advertises encryption and privacy must be able to back this up with regular security testing – even as a distributor of a manufacturer's products.

Relevance to training and awareness

Substantiating security claims in advertising; security testing of connected devices

Missing or inadequate training played a role in the decision.

Authority / court: Office of the New York State Attorney General (Bureau of Internet & Technology)
Area of law: Information security and cyber · Security measures and risk management
Legal basis: New York Executive Law § 63(12); New York General Business Law §§ 349, 350
Action: Fine
Status of proceedings: final
Sector: Retail and e-commerce
Published: 28 Jan 2025

Sources

NYAG, In the Matter of Fantasia Trading LLC, Power Mobile Life LLC and Smart Innovation, LLC, Assurance of Discontinuance No. 24-103 (wirksam 24.01.2025) Decision of an authority
NYAG-Pressemitteilung: Attorney General James Secures $450,000 from Companies Selling Home Security Cameras that Failed to Secure Private Videos (28.01.2025) Press release of an authority

Checked against the official source on 4 Oct 2026 · Direct link

Report an error

23 Jan 2025 PayPal, Inc.NYDFS: $2 million against PayPal over untrained teams and missing MFA USA, NYSecurity measures and risk management €1.92m

When changing data flows for 1099-K tax forms, insufficiently trained teams bypassed security processes; criminals with compromised credentials were able to retrieve forms containing social security numbers. According to the New York State Department of Financial Services (NYDFS), qualified personnel, training, access policies as well as MFA, CAPTCHA and rate limiting were lacking.

What organisations can take from it

Anyone changing data flows must know the security processes – training development teams is part of cyber defence.

Relevance to training and awareness

Secure software development and change processes

Missing or inadequate training played a role in the decision.

Authority / court: New York State Department of Financial Services (NYDFS)
Area of law: Information security and cyber · Security measures and risk management
Legal basis: 23 NYCRR Part 500 (Cybersecurity Regulation)
Action: Fine
Status of proceedings: final
Sector: Financial services and insurance
Employees: 10,000 or more
Culpability: negligent
Mitigating circumstances: PayPal has since remedied the deficiencies.
Published: 23 Jan 2025

Original amount 2,000,000 USD, converted at the ECB reference rate of 23 Jan 2025.

Sources

DFS-Pressemitteilung vom 23.01.2025: Cybersecurity-Vergleich mit PayPal, Inc. (2 Mio. $) Press release of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

7 Jan 2025 City of Boardman (Oregon)City of Boardman: 8,770 USD – water system's risk assessment was an empty template USACritical infrastructure €8,438

The U.S. Environmental Protection Agency (EPA, Region 10) imposed a civil penalty of 8,770 USD by consent agreement and final order on the City of Boardman (Oregon), whose drinking water system serves around 4,490 people. According to the EPA, the city had not prepared the risk and resilience assessment and emergency response plan required by the Safe Drinking Water Act on time and had not complied with a 2022 EPA order: at an inspection in April 2024 the assessment was an empty template, and the emergency response plan dated from 2005 and contained no cybersecurity section. The city admitted jurisdiction without admitting or denying the factual allegations and waived its right to appeal. The authority allegedly made the findings set out here; this account is not based on a final judgment.

What organisations can take from it

Mandatory assessments of physical and cyber security must be substantively prepared and kept up to date – a template that has merely been certified does not meet the obligation.

Relevance to training and awareness

Actually prepare the risk and resilience assessment, including cybersecurity, and keep the emergency response plan current

Authority / court: U.S. Environmental Protection Agency (EPA), Region 10
Area of law: Information security and cyber · Critical infrastructure
Legal basis: Safe Drinking Water Act Section 1433(a) und (b) (42 U.S.C. § 300i-2) sowie Section 1414(g)(3)(A); Strafe nach Section 1414(g)(3)(B) (42 U.S.C. § 300g-3(g)(3)(B))
Action: Fine
Status of proceedings: final
Sector: Energy and utilities
Repeat case: yes
Published: 7 Jan 2025

Original amount 8,770 USD, converted at the ECB reference rate of 7 Jan 2025.

Sources

EPA Region 10 – Consent Agreement, In the Matter of City of Boardman, Docket No. SDWA-10-2025-0022 (eingereicht 07.01.2025) Decision of an authority
EPA Region 10 – Final Order, City of Boardman, Docket No. SDWA-10-2025-0022 (07.01.2025) Decision of an authority
EPA Administrative Enforcement Dockets – SDWA-10-2025-0022 (Status Closed, Payment Received) Enforcement database of an authority

Checked against the official source on 3 Oct 2026 · Direct link

Report an error

20 Dec 2024 Marriott International, Inc. und Starwood Hotels & Resorts Worldwide LLCFTC: Marriott and Starwood must upgrade security after three data breaches affecting 344 million people USASecurity measures and risk management Order

According to the Federal Trade Commission (FTC, the US consumer protection authority), three attacks between 2014 and 2020 affected more than 344 million guests worldwide, including 5.25 million unencrypted passport numbers; one intrusion went undetected for 14 months. The FTC alleges inadequate password, access, firewall and segmentation controls, failure to patch, insufficient logging and too little MFA; the order finalised in December 2024 requires a security programme with annual certification to the FTC for 20 years, independent assessments every two years, data minimisation and a deletion option for US customers. In parallel, Marriott pays 52 million USD to 49 states and Washington, D.C.

What organisations can take from it

Review the security of acquired systems before and immediately after closing – an acquisition brings its legacy IT problems with it.

Relevance to training and awareness

Patching, network segmentation and MFA after company acquisitions

Authority / court: Federal Trade Commission (FTC)
Area of law: Information security and cyber · Security measures and risk management
Legal basis: Section 5 FTC Act
Action: Order
Status of proceedings: final
Sector: Other
Employees: 10,000 or more
Published: 20 Dec 2024

Sources

FTC Takes Action Against Marriott and Starwood Over Multiple Data Breaches Press release of an authority
FTC Finalizes Order with Marriott and Starwood Requiring Them to Implement a Robust Data Security Program to Address Security Failures Press release of an authority
Marriott International, Inc. and Starwood Hotels & Resorts Worldwide, LLC, In the Matter of Enforcement database of an authority

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

Report an error

28 Nov 2024 Meta PlatformsMeta: 5 million KRW for reporting an Instagram outage late South KoreaIncident reporting obligations €3,396

After a login outage of around 75 minutes on Instagram on 22 March 2024 that affected some 3.35 million users in Korea, Meta Platforms reported the incident only 24 hours and 19 minutes after it began, despite three requests from the Ministry. A report within 10 minutes and a written report within two hours are required; the Ministry imposed an administrative fine of 5,000,000 KRW under the Framework Act on Broadcasting and Communications Development (방송통신발전 기본법). The amount and the facts have not been confirmed against the primary source.

What organisations can take from it

Large platform operators need a rehearsed reporting process so that outages reach the regulator within the statutory deadlines measured in minutes.

Relevance to training and awareness

Reporting and escalation routes for IT outages

Authority / court: Ministry of Science and ICT (MSIT, 과학기술정보통신부)
Area of law: Information security and cyber · Incident reporting obligations
Legal basis: Framework Act on Broadcasting and Communications Development (방송통신발전 기본법) Art. 38; Basisplan zum Management von Kommunikationsstörungen 2024
Action: Fine
Status of proceedings: unknown
Sector: Media and online platforms
Employees: 10,000 or more
Published: 28 Nov 2024

Original amount 5,000,000 KRW, converted at the ECB reference rate of 28 Nov 2024.

Sources

MSIT-Pressemitteilung vom 28.11.2024: ‘통신재난 보고의무 미준수’ 메타에 과태료 처분 Press release of an authority
MSIT-Pressemitteilung vom 28.11.2024 (Anhang, HWPX) Press release of an authority

Checked against the official source on 4 Oct 2026 · Direct link

Report an error

25 Nov 2024 Government Employees Insurance Company (GEICO)GEICO: 5 million USD from NYDFS over cyberattacks on quoting and claims portals USA, NYSecurity measures and risk management €4.76m

From late 2020 onwards, attackers obtained non-public data of New Yorkers, above all driver's licence numbers, in several incidents through publicly accessible web applications of the car insurer GEICO – including the quoting portal, the claims website and an interface. The New York State Department of Financial Services (NYDFS) found breaches of the cybersecurity regulation 23 NYCRR Part 500, including inadequate risk assessments, missing monitoring of user activity and incorrect compliance certifications for 2017 to 2021, and imposed a penalty of 5,000,000 USD. In parallel, GEICO pays a further 4,750,000 USD in a separate settlement with the New York Attorney General. The authority allegedly made the findings set out here; this account is not based on a final judgment.

What organisations can take from it

After an incident it is not enough to close the one gap – all publicly accessible applications need to be reassessed, especially once the industry has been warned.

Relevance to training and awareness

Security of publicly accessible web applications; responding to industry alerts

Authority / court: New York State Department of Financial Services (NYDFS)
Area of law: Information security and cyber · Security measures and risk management
Legal basis: 23 NYCRR §§ 500.2(b), 500.3(i) und (k), 500.5, 500.8(a), 500.9(a), 500.14(a), 500.17(b); Strafe nach New York Financial Services Law § 408
Action: Fine
Status of proceedings: final
Sector: Financial services and insurance
Mitigating circumstances: The NYDFS acknowledged the company's cooperation during the investigation and its substantial investment in remediating the shortcomings.
Published: 25 Nov 2024

Original amount 5,000,000 USD, converted at the ECB reference rate of 25 Nov 2024.

Sources

NYDFS, In the Matter of Government Employees Insurance Company, Consent Order (so ordered 25.11.2024) Decision of an authority
NYDFS-Pressemitteilung: Attorney General James and DFS Superintendent Harris Secure $11.3 Million from Auto Insurance Companies over Data Breaches (25.11.2024) Press release of an authority

Checked against the official source on 3 Oct 2026 · Direct link

Report an error

1 Oct 2024 a US swap trading platformSwap trading platform: 875,000 USD because emergency and security tests were not brought before the board USACritical infrastructureanonymised €789,284

A US swap trading platform did not fully inform its board of the results of emergency, technology risk and penetration tests, did not regularly test its business continuity and disaster recovery capabilities and had no adequate risk management. It also failed to produce documents requested during an examination on time despite extensions of deadlines; the Commodity Futures Trading Commission (CFTC) imposed 875,000 USD.

What organisations can take from it

Contingency plans only count if they are tested regularly and the results are noted by the entire governing body.

Authority / court: Commodity Futures Trading Commission (CFTC)
Area of law: Information security and cyber · Critical infrastructure
Legal basis: Commodity Exchange Act; CFTC-Regeln zu System Safeguards für Swap Execution Facilities
Action: Fine
Status of proceedings: final
Sector: Financial services and insurance

Original amount 875,000 USD, converted at the ECB reference rate of 1 Oct 2024.

Sources

CFTC, Pressemitteilungen (Übersicht) (Entscheidung 2024) Press release of an authority

Checked against the official source on 28 Sep 2026 · Version 3 · Company name anonymised since 1 Oct 2026 · Direct link

Report an error

5 Jul 2024 a London borough councilICO: reprimand for London borough council after a ransomware attack United KingdomSecurity measures and risk managementanonymised Reprimand or warning

On 5 July 2024 the ICO issued an (updated) reprimand to a London borough council. According to the reprimand, it followed a ransomware attack that the council became aware of on 11 October 2020: the attacker was able to access and encrypt 440,000 files containing personal data, including special category data, relating to at least 280,000 residents and other people, including staff. According to the ICO's findings, patch management and user account management were inadequate, in breach of Articles 5(1)(f) and 32(1)(b) UK GDPR. The ICO had initially considered a fine but, taking into account its approach to the public sector and the circumstances of the case, decided on a reprimand.

Authority / court: Information Commissioner's Office (ICO)
Area of law: Information security and cyber · Security measures and risk management
Legal basis: Art. 5(1)(f) und 32(1)(b) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR
Action: Reprimand or warning
Status of proceedings: unknown
Sector: Public sector

Sources

ICO, Übersicht der Durchsetzungsmaßnahmen (Entscheidung 2024) Enforcement database of an authority

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 5 Jul 2026 · Direct link

Report an error

21 Jun 2024 a UK law firmICO: reprimand for law firm after a data leak without multi-factor authentication United KingdomSecurity measures and risk managementanonymised Reprimand or warning

The ICO issued a reprimand to a law firm specialising in criminal and military law. According to the ICO's findings, an unknown attacker used valid credentials to get into the firm's cloud server and later published data on the dark web. The incident affected 8,234 people in the UK, 863 of them at high risk because criminal proceedings data was involved. The ICO criticised the lack of multi-factor authentication and of a password policy for the compromised administrator account, and the fact that the firm had not checked since 2012 whether the security measures in its contract with its outsourced IT provider were adequate. It found infringements of Articles 32(1)(b) and 32(1)(d) UK GDPR. The reprimand is undated; the date follows the ICO case page.

Authority / court: Information Commissioner's Office (ICO)
Area of law: Information security and cyber · Security measures and risk management
Legal basis: Art. 32(1)(b) und 32(1)(d) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR
Action: Reprimand or warning
Status of proceedings: unknown
Sector: Other

Sources

ICO, Übersicht der Durchsetzungsmaßnahmen (Entscheidung 2024) Enforcement database of an authority

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 21 Jun 2026 · Direct link

Report an error

22 May 2024 a US exchange group and nine of its subsidiariesUS exchange group: 10 million USD – cyber attack not reported to the SEC USAIncident reporting obligationsanonymised €9.23m

In April 2021, a third party alerted the group to a vulnerability in its VPN; the group found malicious code that had been inserted but did not inform the legal and compliance officers of its exchange and clearing subsidiaries for days. As a result, the subsidiaries, including a stock exchange, did not immediately report the incident to the U.S. Securities and Exchange Commission (SEC) as required under Regulation SCI; the group paid 10 million USD.

What organisations can take from it

Operators of critical market infrastructure need internal reporting channels that pass cyber incidents on to all entities subject to reporting obligations within hours.

Relevance to training and awareness

Internal escalation of cyber incidents to compliance

Authority / court: U.S. Securities and Exchange Commission (SEC)
Area of law: Information security and cyber · Incident reporting obligations
Legal basis: Regulation Systems Compliance and Integrity (Regulation SCI), Meldepflichten
Action: Fine
Status of proceedings: final
Sector: Financial services and insurance
Employees: 10,000 or more
Repeat case: yes

Original amount 10,000,000 USD, converted at the ECB reference rate of 22 May 2024.

Sources

SEC, Pressemitteilungen (Übersicht) (Entscheidung 2024) Press release of an authority

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 22 May 2026 · Direct link

Report an error

21 May 2024 a Dutch telecommunications providerNetherlands: 2.25 million EUR against a telecommunications provider over inadequately secured interception system NetherlandsCritical infrastructureanonymised €2.25m

According to the Dutch Authority for Digital Infrastructure (RDI), a Dutch telecommunications provider did not take the necessary measures from October 2021 to December 2022 to protect data from lawful interception of telecommunications against unauthorised persons: the security plan was inadequate, staff with access had not been sufficiently screened (missing job descriptions, confidentiality declarations, certificates of conduct), and logical and physical access controls were deficient. No actual unauthorised access was found; the fine amounts to 2.25 million EUR.

What organisations can take from it

Treat interfaces for access by authorities as high-risk systems; document access controls and staff screening completely.

Relevance to training and awareness

Access control and staff screening for interception interfaces

Authority / court: Rijksinspectie Digitale Infrastructuur (RDI)
Area of law: Information security and cyber · Critical infrastructure
Legal basis: Telecommunicatiewet Art. 15.4; Besluit beveiliging gegevens telecommunicatie (Bbgt) Art. 2, 3, 4, 8
Action: Fine
Status of proceedings: unknown
Sector: Telecoms, IT and software
Mitigating circumstances: Deficiencies remedied after they were identified; no actual unauthorised access found.
Published: 22 Oct 2024

Sources

RDI, Nachrichten (Übersicht) (Entscheidung 2024) Press release of an authority

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 21 May 2026 · Direct link

Report an error

20 May 2024 a US data services providerFTC: US data services provider must delete legacy data and strengthen security after hacker attack USASecurity measures and risk managementanonymised Order

According to the complaint of the Federal Trade Commission (FTC, the US consumer protection authority), an attacker exploited weaknesses in the network of the data services provider for companies and non-profit organisations in early 2020 and stole large amounts of unencrypted data, including Social Security and bank account numbers of millions of people; the attack went undetected for three months, the provider informed its customers only after almost two months and misrepresented the extent. The final order requires a comprehensive security programme, a data retention schedule, deletion of data no longer needed and notification of future reportable incidents to the FTC.

What organisations can take from it

Set retention periods and deletion routines as security measures – data that is no longer needed is pure risk in an attack.

Relevance to training and awareness

Data minimisation, encryption and honest incident communication

Authority / court: Federal Trade Commission (FTC)
Area of law: Information security and cyber · Security measures and risk management
Legal basis: Section 5 FTC Act
Action: Order
Status of proceedings: final
Sector: Telecoms, IT and software
Published: 20 May 2024

Sources

FTC, Pressemitteilungen (Übersicht) (Entscheidung 2024) Press release of an authority

Checked against the official source on 28 Sep 2026 · Version 3 · Company name anonymised since 20 May 2026 · Direct link

Report an error

9 May 2024 a UK public bodyICO: reprimand for UK public body after an attack on its email server United KingdomSecurity measures and risk managementanonymised Reprimand or warning

The ICO issued a reprimand to a UK public body. According to the ICO's findings, unknown attackers got into the body's on-premises email server from 24 August 2021 via a chain of known vulnerabilities; the data affected came mainly from the electoral register, with the names and home addresses of around 40 million people. The security patches for these vulnerabilities had been released in April and May 2021 but had not been applied. In addition, an audit found that 178 active accounts could be cracked quickly because their passwords were identical or similar to the initial passwords issued by the service desk. The ICO found infringements of Articles 5(1)(f) and 32(1)(b) UK GDPR. The reprimand is undated; the date follows the ICO case page.

Authority / court: Information Commissioner's Office (ICO)
Area of law: Information security and cyber · Security measures and risk management
Legal basis: Art. 5(1)(f) und 32(1)(b) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR
Action: Reprimand or warning
Status of proceedings: unknown
Sector: Public sector

Sources

ICO, Übersicht der Durchsetzungsmaßnahmen (Entscheidung 2024) Enforcement database of an authority

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 9 May 2026 · Direct link

Report an error

12 Mar 2024 a Polish major bankPolish major bank: 1.44 million PLN – stolen customer documents not reported PolandIncident reporting obligationsanonymised €336,066

A courier consignment containing bank documents (including PESEL numbers, account numbers, login credentials) was stolen and discarded on a housing estate; the supervisory authority learned of it from the media. The bank had informed neither the authority nor the data subjects because it rated the risk as low – it had already been sanctioned in 2022 for failing to notify data subjects.

What organisations can take from it

Assess the risk of a data breach from the data subjects’ perspective – failing to notify the loss of sensitive documents risks a higher penalty than the breach itself.

Relevance to training and awareness

Risk assessment and notification of data breaches

Authority / court: Prezes Urzędu Ochrony Danych Osobowych (UODO)
Area of law: Information security and cyber · Incident reporting obligations
Legal basis: Art. 33 Abs. 1, Art. 34 Abs. 1 DSGVO
Action: Fine
Status of proceedings: unknown
Sector: Financial services and insurance
Employees: 10,000 or more
Repeat case: yes
Published: 2 Apr 2024

Original amount 1,440,549 PLN, converted at the ECB reference rate of 12 Mar 2024.

Sources

UODO, Nachrichten (Übersicht) (Entscheidung 2024) Press release of an authority
UODO, Entscheidungsdatenbank (Suche) (Entscheidung 2024) Decision of an authority

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 12 Mar 2026 · Direct link

Report an error

12 Mar 2024 a Polish bank belonging to a car manufacturerPolish bank: 78,575 PLN – misdirected mailing reported only after 1.5 years PolandIncident reporting obligationsanonymised €18,331

The bank sent a customer’s contract data to the wrong recipient and only reported the breach one and a half years later, when the supervisory authority made enquiries following a complaint. Given the risk of identity theft, the authority considered that there had been an obligation to notify within 72 hours.

What organisations can take from it

Even a single misdirected mailing containing identity data is notifiable – misdirected mail cases need a documented risk assessment.

Relevance to training and awareness

Recognising misdirected mail and reporting it internally

Authority / court: Prezes Urzędu Ochrony Danych Osobowych (UODO)
Area of law: Information security and cyber · Incident reporting obligations
Legal basis: Art. 33 Abs. 1 DSGVO
Action: Fine
Status of proceedings: final
Sector: Financial services and insurance
Published: 2 Apr 2024

Original amount 78,575.4 PLN, converted at the ECB reference rate of 12 Mar 2024.

Sources

UODO, Nachrichten (Übersicht) (Entscheidung 2024) Press release of an authority
UODO, Entscheidungsdatenbank (Suche) (Entscheidung 2024) Decision of an authority

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 12 Mar 2026 · Direct link

Report an error

8 Feb 2024 a German major bankBaFin fines a major bank €50,000 for flawed reporting of an IT security incident GermanyIncident reporting obligationsanonymised €50,000

BaFin (German Federal Financial Supervisory Authority) imposed a fine of 50,000 EUR on a German major bank because the bank had given it incorrect information about a major customer-relevant IT security incident affecting its payment services in 2023 and had informed it considerably late. The decision of 8 February 2024 is final.

What organisations can take from it

IT incident reports must be fast and accurate; incorrect information given to the supervisor is sanctioned in its own right.

Relevance to training and awareness

Reporting major IT security incidents correctly and on time

Authority / court: Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin)
Area of law: Information security and cyber · Incident reporting obligations
Legal basis: § 64 Abs. 3 Nr. 15 ZAG
Action: Fine
Status of proceedings: final
Sector: Financial services and insurance
Employees: 10,000 or more
Published: 18 Mar 2024

Sources

BaFin, Maßnahmen und Sanktionen (Übersicht) (Entscheidung 2024) Press release of an authority

Checked against the official source on 2 Oct 2026 · Company name anonymised since 8 Feb 2026 · Direct link

Report an error

7 Dec 2023 an English multi-academy trustICO: reprimand for multi-academy trust after an attack using compromised credentials United KingdomSecurity measures and risk managementanonymised Reprimand or warning

The ICO issued a reprimand to an English multi-academy trust, which runs schools. According to the ICO, an unauthorised third party used compromised credentials to access and encrypt the trust's systems. According to the ICO's findings, appropriate technical measures were missing: the account lockout policy was inadequate and reversible password encryption was enabled, contrary to National Cyber Security Centre recommendations. The ICO found infringements of Articles 5(1)(f) and 32(1)(b) UK GDPR. The reprimand is undated; the date follows the ICO case page.

Authority / court: Information Commissioner's Office (ICO)
Area of law: Information security and cyber · Security measures and risk management
Legal basis: Art. 5(1)(f) und 32(1)(b) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR
Action: Reprimand or warning
Status of proceedings: unknown
Sector: Public sector

Sources

ICO, Übersicht der Durchsetzungsmaßnahmen (Entscheidung 2023) Enforcement database of an authority

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 7 Dec 2025 · Direct link

Report an error

27 Nov 2023 a US title insurerNYDFS: $1 million against US title insurer over open document links USA, NYSecurity measures and risk managementanonymised €913,159

An application of the insurer generated links to transaction documents without login and without an expiry date; according to a journalist, by changing the sequential document number, 885 million documents containing, among other things, social security and bank data could be retrieved. Users were told not to send sensitive data, but there were no technical barriers. The penalty was imposed by the New York State Department of Financial Services (NYDFS).

What organisations can take from it

Instructions to users do not replace technical controls – sharing links need authentication and an expiry date.

Relevance to training and awareness

Classification and sending of sensitive documents

Authority / court: New York State Department of Financial Services (NYDFS)
Area of law: Information security and cyber · Security measures and risk management
Legal basis: 23 NYCRR §§ 500.3, 500.7 (Cybersecurity Regulation)
Action: Fine
Status of proceedings: final
Sector: Financial services and insurance
Culpability: negligent

Original amount 1,000,000 USD, converted at the ECB reference rate of 27 Nov 2023.

Sources

NYDFS, Newsroom (Übersicht) (Entscheidung 2023) Decision of an authority

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 27 Nov 2025 · Direct link

Report an error

17 Nov 2023 a Luxembourg credit institutionLuxembourg credit institution: EUR 444,400 for IT governance failings LuxembourgSecurity measures and risk managementanonymised €444,400

The CSSF imposed an administrative fine (amende d'ordre) of EUR 444,400 on the credit institution because its internal governance and control over ICT and security risks fell short of the requirements. The fine followed an on-site inspection from October 2022 to June 2023 concerning Art. 5(1bis) LSF (Luxembourg Law on the Financial Sector) and CSSF Circulars 20/750 and 12/552.

What organisations can take from it

IT and security risks need their own documented governance and control framework; the supervisor sanctions gaps in it as a breach in their own right.

Relevance to training and awareness

ICT governance and control of IT and security risks

Authority / court: Commission de Surveillance du Secteur Financier (CSSF)
Area of law: Information security and cyber · Security measures and risk management
Legal basis: Art. 63-2(1)(d) und (2)(e) Loi modifiée du 5 avril 1993 relative au secteur financier (LSF); verletzt Art. 5(1bis) LSF; Circulaires CSSF 20/750 und 12/552
Action: Fine
Status of proceedings: unknown
Sector: Financial services and insurance
Mitigating circumstances: The institution accepted all findings, submitted a detailed action plan and started remediation immediately.
Published: 20 Feb 2024

Sources

CSSF, Sanction administrative du 17 novembre 2023 (Mizuho Trust & Banking (Luxembourg) S.A.) Decision of an authority

Checked against the official source on 2 Oct 2026 · Company name anonymised since 17 Nov 2025 · Direct link

Report an error

14 Nov 2023 a UK construction materials supplierICO: reprimand for construction materials supplier after a ransomware attack via remote access without MFA United KingdomSecurity measures and risk managementanonymised Reprimand or warning

The ICO issued a reprimand to a UK supplier of construction materials. According to the ICO, on 11 March 2022 a threat actor gained access to the network, deployed ransomware and exfiltrated data, including personal data of 2,022 current and former UK employees (among other things identity documents, bank details and HR records). According to the ICO's findings, access was gained through a subsidiary's remote desktop service that had no multi-factor authentication; in addition, the company had carried out no formal security testing such as vulnerability scanning or penetration testing before the incident, and the attacker exploited a vulnerability that had been public for more than two years. The ICO found infringements of Article 32(1), 32(1)(b) and 32(1)(d) UK GDPR. The reprimand is undated; the date follows the ICO case page.

Authority / court: Information Commissioner's Office (ICO)
Area of law: Information security and cyber · Security measures and risk management
Legal basis: Art. 32(1), 32(1)(b) und 32(1)(d) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR
Action: Reprimand or warning
Status of proceedings: unknown
Sector: Construction and real estate

Sources

ICO, Übersicht der Durchsetzungsmaßnahmen (Entscheidung 2023) Enforcement database of an authority

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 14 Nov 2025 · Direct link

Report an error

Who was sanctioned, and for what?

Where?

What for?

Who?

When?

58 cases

Ready for training that actually lands?

Period	Cases	Total
2022	5	€75.1m
2023	17	€94.9m
2024	13	€17.4m
2025	17	€33.7m
2026	6	€4.36m