Who was sanctioned, and for what?

From 2016 to 2025, the operator of the OTC Link ATS trading system lacked complete policies on systems security, access control and vulnerability management as required under Regulation SCI. Although the examiners of the U.S. Securities and Exchange Commission (SEC) had criticised the gaps in several examinations, drafts remained unfinished; the SEC issued a censure and imposed 575,000 USD.

Authority / court

U.S. Securities and Exchange Commission (SEC)

Area of law

Information security and cyber · Critical infrastructure

Legal basis

Regulation SCI, Rule 1001(a)(1)–(3)

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Repeat case

yes

Original amount 575,000 USD, converted at the ECB reference rate of 22 Sep 2026.

Checked against the official source on 25 Sep 2026 · Direct link

The licensed money transmitter had no adequate policies for system updates and insufficient risk assessments under New York's cybersecurity regulation, as found by the New York State Department of Financial Services (NYDFS). The company has already remedied the deficiencies.

Authority / court

New York State Department of Financial Services (NYDFS)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

23 NYCRR Part 500 (Cybersecurity Regulation)

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Mitigating circumstances

Because of its low turnover, the company was exempt from many Part 500 obligations; deficiencies already remedied.

Published

5 Aug 2026

Original amount 250,000 USD, converted at the ECB reference rate of 5 Aug 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Luk Fook Securities (HK) was publicly reprimanded and fined 2,100,000 HKD because inadequate cybersecurity controls might have contributed to a ransomware attack on 19 September 2022 hitting numerous core servers and to full recovery taking until 7 October 2022; during that time clients could not trade via the app or internet platform. Findings included missing firewall protection, outdated operating systems and antivirus software, weak access and password controls with credentials stored unencrypted, insufficient controls over remote access and external devices, inadequate data backup and a last security training session in 2018.

Authority / court

Securities and Futures Commission (SFC)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

s. 194 SFO (Cap. 571); Code of Conduct GP 2, GP 3, GP 7, paras. 12.1, 18.5 und Schedule 7; Guidelines for Reducing and Mitigating Hacking Risks Associated with Internet Trading

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Repeat case

no

Mitigating circumstances

Root-cause review with an independent reviewer, strengthened controls, no evidence of client loss, cooperation, clean disciplinary record.

Published

28 Jul 2026

Original amount 2,100,000 HKD, converted at the ECB reference rate of 28 Jul 2026.

Checked against the official source on 3 Oct 2026 · Direct link

In 2023, attackers exploited a zero-day vulnerability in MOVEit Transfer to steal files containing social security, driving licence, account and health data. The New York State Department of Financial Services (NYDFS) criticised inadequate retention settings, policies and controls as well as the late notification of the cybersecurity incidents to the supervisory authority.

Authority / court

New York State Department of Financial Services (NYDFS)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

23 NYCRR Part 500 (Cybersecurity Regulation)

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Culpability

negligent

Published

30 Apr 2026

Original amount 2,250,000 USD, converted at the ECB reference rate of 29 Apr 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Acting as processor, the property management company sent an owner’s statement of service charges to an unauthorised person. The association considered notification unnecessary because only ‘ordinary’ data of one member were affected, and maintained this position in the proceedings; the UODO (Poland’s data protection authority) imposed 4,852 PLN.

Authority / court

Prezes Urzędu Ochrony Danych Osobowych (UODO)

Area of law

Information security and cyber · Incident reporting obligations

Legal basis

Art. 33 Abs. 1 DSGVO

Action

Fine

Status of proceedings

final

Sector

Construction and real estate

Original amount 4,852 PLN, converted at the ECB reference rate of 7 Apr 2026.

Checked against the official source on 25 Sep 2026 · Direct link

The Federal Court of Australia, on application by the Australian Securities and Investments Commission (ASIC, Australia's corporate, markets and financial services regulator), imposed a penalty of 2.5 million AUD on the fixed-income specialist because between March 2019 and June 2023 it lacked adequate cyber security measures, resources and risk management systems – among other things, there was no multi-factor authentication for remote access, no regular penetration testing and no mandatory security awareness training. In a 2023 attack around 385 GB of confidential data were stolen and some 18,000 clients were notified; the court also ordered a compliance programme with an independent expert.

Authority / court

Federal Court of Australia (auf Antrag der Australian Securities and Investments Commission, ASIC)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

Corporations Act 2001 (Cth) s 912A(1)(a), (d) und (h) i. V. m. s 912A(5A)

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Repeat case

no

Mitigating circumstances

Full cooperation, admissions and an agreed statement of facts; no previous contraventions; the known financial losses (remediation costs of around 1.5 million AUD) were largely borne by the company itself.

Published

9 Feb 2026

Original amount 2,500,000 AUD, converted at the ECB reference rate of 9 Feb 2026.

Checked against the official source on 3 Oct 2026 · Direct link

On 8 October 2024 Singtel's fixed-line voice service failed for more than four hours for around 500,000 residential and corporate users; customer service lines of government agencies, healthcare organisations and banks as well as emergency call services were also affected. The cause was that the virtualised firewalls of the voice system and of a monitoring system shared the same hardware, so that an overload of the insufficiently filtered monitoring system also disrupted the voice system and the automatic failover did not work cleanly; according to the investigation, there was no cyber-attack. The Infocomm Media Development Authority (IMDA, Singapore's telecoms and media regulator) imposed a penalty of SGD 1 million under the Telecommunications Act because the incident had been within Singtel's control to prevent.

Authority / court

Infocomm Media Development Authority (IMDA)

Area of law

Information security and cyber · Critical infrastructure

Legal basis

Telecommunications Act

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Employees

10,000 or more

Published

11 Dec 2025

Original amount 1,000,000 SGD, converted at the ECB reference rate of 11 Dec 2025.

Checked against the official source on 4 Oct 2026 · Direct link

Following proceedings brought by the Commerce Commission (New Zealand's competition and consumer regulator), the High Court ordered One New Zealand Group Limited to pay a pecuniary penalty of 1,100,000 NZD; in addition, the company is paying 100,000 NZD towards the authority's costs, which is not included in the amount. One NZ admitted ten breaches of the 111 Contact Code between 2021 and 2023 concerning information duties, record-keeping and regular contact with customers. The Code is intended to ensure that vulnerable customers whose landline does not work in a power cut receive another way of calling 111 at no cost.

Authority / court

High Court of New Zealand (Verfahren der Commerce Commission)

Area of law

Information security and cyber · Critical infrastructure

Legal basis

Telecommunications Act 2001 (Neuseeland), s 156B; 111 Contact Code

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Mitigating circumstances

According to the Commerce Commission, One NZ remedied the breaches as soon as it recognised their scale and cooperated fully with the investigation; the breaches were admitted.

Published

1 Dec 2025

Original amount 1,100,000 NZD, converted at the ECB reference rate of 1 Dec 2025.

Checked against the official source on 3 Oct 2026 · Direct link

In October 2023, an uninvolved person received a debtor’s enforcement documents containing name, address, date of birth, PESEL number, amount of the claim and employer. The bailiff’s office neither notified the supervisory authority nor informed the data subject; the UODO (Poland’s data protection authority) imposed 7,700 PLN for the failure to notify and 13,200 PLN for the failure to inform the data subject, and ordered the data subject to be informed within three days.

Authority / court

Prezes Urzędu Ochrony Danych Osobowych (UODO)

Area of law

Information security and cyber · Incident reporting obligations

Legal basis

Art. 33 Abs. 1, Art. 34 Abs. 1 und 2 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Original amount 20,900 PLN, converted at the ECB reference rate of 23 Oct 2025.

Checked against the official source on 25 Sep 2026 · Direct link

In inspections in 2021/22, the RDI (Rijksinspectie Digitale Infrastructuur, the Dutch Authority for Digital Infrastructure) found that the mobile operator had no mandatory security plan for its system for lawful interception of telecommunications, that employees with access had not been adequately screened (missing job descriptions, confidentiality declarations, certificates of conduct), that unauthorised persons had access to interception data and that suppliers could access the system digitally. The RDI imposed 1,518,750 EUR; Odido has since renewed the system.

Authority / court

Rijksinspectie Digitale Infrastructuur (RDI)

Area of law

Information security and cyber · Critical infrastructure

Legal basis

Telecommunicatiewet Art. 15.4; Besluit beveiliging gegevens telecommunicatie (Bbgt) Art. 2, 3, 4

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Mitigating circumstances

System renewed, risk of unauthorised access eliminated.

Published

17 Oct 2025

Checked against the official source on 28 Sep 2026 · Direct link

Attackers harvested driving licence numbers and dates of birth via inadequately secured online quoting tools and agent portals. According to the New York State Department of Financial Services (NYDFS), Farmers infringed the cybersecurity regulation and did not report the incident in time; the penalty is part of a package totalling $19 million against eight motor insurers.

Authority / court

New York State Department of Financial Services (NYDFS)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

23 NYCRR Part 500 (Cybersecurity Regulation)

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Culpability

negligent

Published

14 Oct 2025

Original amount 2,775,000 USD, converted at the ECB reference rate of 14 Oct 2025.

Checked against the official source on 25 Sep 2026 · Direct link

Attackers extracted driver’s licence numbers in plain text via the motor insurer’s instant quote applications. Infinity discovered the anomalies on 9 February 2021 but only reported the cybersecurity event to the New York State Department of Financial Services (NYDFS) on 14 April 2021; the supervisor also criticised the lack of MFA and insecure development practices.

Authority / court

New York State Department of Financial Services (NYDFS)

Area of law

Information security and cyber · Incident reporting obligations

Legal basis

23 NYCRR § 500.17(a), § 500.12(a) u. a.

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Culpability

negligent

Original amount 2,250,000 USD, converted at the ECB reference rate of 14 Oct 2025.

Checked against the official source on 25 Sep 2026 · Direct link

After an update of the PSD2 interface for third-party providers in July 2023, the confidentiality of 57 IBAN accounts of bank customers was not ensured. The banking supervisor, Banka Slovenije (Bank of Slovenia), issued a reprimand to the bank for breaching the obligation to protect confidential data (final).

Authority / court

Banka Slovenije

Area of law

Information security and cyber · Security measures and risk management

Legal basis

Art. 146, Art. 396 Abs. 1 Nr. 18 ZBan-3 (slowenisches Bankengesetz)

Action

Reprimand or warning

Status of proceedings

final

Sector

Financial services and insurance

Liability of senior managers

Measures against individuals are not reported here.

Checked against the official source on 28 Sep 2026 · Version 3 · Direct link

Customer data (including names, e-mail addresses, dates of birth, telephone numbers) could be retrieved via an unprotected development server of the advertising agency. An employee took the first alert from an external party in January 2025 to be spam; only a second alert in February reached management, which closed the gap but only notified the incident on 2 May 2025 after being requested to do so by the Datenschutzbehörde (Austrian Data Protection Authority, DSB). The authority attributed the employee’s conduct to the company.

Authority / court

Datenschutzbehörde (DSB)

Area of law

Information security and cyber · Incident reporting obligations

Legal basis

Art. 33 Abs. 1 iVm Art. 83 Abs. 4 lit. a DSGVO

Action

Fine

Status of proceedings

final

Sector

Media and online platforms

Culpability

negligent

Mitigating circumstances

No previous infringements and cooperation in the proceedings; gap closed immediately after the second alert, employees trained subsequently.

Checked against the official source on 25 Sep 2026 · Direct link

An employee of the dental insurance service provider disclosed his login credentials via a phishing e-mail; the mailbox containing over 100,000 e-mails with health and social security data was accessible. Healthplex had known about the incident since November 2021 but only reported it to the New York State Department of Financial Services (NYDFS) in April 2022 instead of within 72 hours; in addition, there was no MFA for web access and no data retention and deletion policy.

Authority / court

New York State Department of Financial Services (NYDFS)

Area of law

Information security and cyber · Incident reporting obligations

Legal basis

23 NYCRR § 500.17(a), § 500.12(b), § 500.13, § 500.17(b)

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Culpability

negligent

Original amount 2,000,000 USD, converted at the ECB reference rate of 14 Aug 2025.

Checked against the official source on 25 Sep 2026 · Direct link

A fraudster impersonated a customer by e-mail and, between 2021 and 2023, obtained information and documents on three policies from the life insurer’s case handlers without his identity being verified. Although the customer alerted the company to the false e-mail address in September 2024, Poste Vita only notified the breach to the supervisory authority in January 2025.

Authority / court

Garante per la protezione dei dati personali

Area of law

Information security and cyber · Incident reporting obligations

Legal basis

Art. 5 Abs. 1 lit. a und f, Art. 33 Abs. 1 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Culpability

negligent

Mitigating circumstances

Immediate blocking of further communication, internal investigation, criminal complaint and stricter identity verification.

Checked against the official source on 25 Sep 2026 · Direct link

The Nasjonal kommunikasjonsmyndighet (Nkom, Norwegian Communications Authority) imposed an administrative penalty (overtredelsesgebyr) of 50,000,000 NOK on Telenor Norge because, on four occasions in autumn 2024 (29 August, 16 September, 17/18 October, 13 November), emergency calls over its network failed entirely or intermittently or were misrouted. The inspection found 22 breaches of ekomloven (Electronic Communications Act), sikkerhetsloven (National Security Act) and several regulations, including inadequate risk assessments, planned work not carried out securely, insufficient redundancy, inadequate auditing of a subcontractor and late notification of the authority. In its final decision Nkom maintained the amount announced in February 2025; the deadline for an administrative appeal ran until 8 September 2025.

Authority / court

Nasjonal kommunikasjonsmyndighet (Nkom)

Area of law

Information security and cyber · Critical infrastructure

Legal basis

ekomloven (lov 4. juli 2003 nr. 83), sikkerhetsloven (lov 1. juni 2018 nr. 24), ekomforskriften, nummerforskriften, klassifiseringsforskriften, virksomhetssikkerhetsforskriften

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Employees

1,000 to 9,999

Published

3 Jul 2025

Original amount 50,000,000 NOK, converted at the ECB reference rate of 3 Jul 2025.

Checked against the official source on 28 Sep 2026 · Direct link

The Finanssivalvonta (FIN-FSA, Finnish Financial Supervisory Authority) imposed a joint penalty payment of 7,670,000 EUR on S-Pankki Oyj for failings in operational risk management and additionally issued a public warning. A programming error that was live in a bank system from 20 April to 5 August 2022 had not been adequately tested beforehand; the bank lacked a sufficiently secure system and effective incident management and was insufficiently prepared for outsourcing risks. The warning concerns the failure to apply the required strong customer authentication and payments executed without the payers' consent from 6 May to 5 August 2022; earlier penalty payments imposed on the bank by the supervisor (2019 and 2021) increased the amount. The decision is not final.

Authority / court

Finanssivalvonta (FIN-FSA)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

Luottolaitostoiminnasta annettu laki 9 luku 16 § (1, 2 und 4 mom.) mit MOK 8/2014; FivaL 40 §, 41 §, 41 b §; öffentliche Verwarnung nach FivaL 39 § wegen Maksupalvelulaki 85 c § 1 mom. und 38 § 1 mom.

Action

Fine

Status of proceedings

under appeal

Sector

Financial services and insurance

Repeat case

yes

Mitigating circumstances

Measures to prevent recurrence and cooperation with the supervisor in the investigation reduced the amount.

Published

23 May 2025

Checked against the official source on 28 Sep 2026 · Direct link

According to the Federal Trade Commission (FTC, the US consumer protection authority), the web host did not use multi-factor authentication for its hosting services, monitored security threats inadequately and did not secure connections to customer data, yet advertised “award-winning security”. The final order prohibits false statements about security and requires a comprehensive information security programme and regular reviews by independent assessors.

Authority / court

Federal Trade Commission (FTC)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

Section 5 FTC Act

Action

Order

Status of proceedings

final

Sector

Telecoms, IT and software

Published

21 May 2025

Checked against the official source on 28 Sep 2026 · Direct link

When the nickel price rose to over 100,000 USD within just over an hour on 8 March 2022, only junior staff were on duty during Asian trading hours, and they had not been trained to recognise a disorderly market; they did not escalate and even switched off price bands. The Financial Conduct Authority (FCA) imposed a fine on the recognised investment exchange for the first time: 9.2 million GBP after a 30% discount.

Authority / court

Financial Conduct Authority (FCA)

Area of law

Information security and cyber · Critical infrastructure

Legal basis

FCA REC 2.5.1 (Recognition Requirements); Art. 18 RTS 7 (MiFID II)

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Mitigating circumstances

Early settlement (30% discount); improvements since March 2022.

Original amount 9,200,000 GBP, converted at the ECB reference rate of 20 Mar 2025.

Checked against the official source on 25 Sep 2026 · Direct link

The New York Attorney General's office concluded an Assurance of Discontinuance with three US distribution companies of the eufy home security brand. Contrary to advertising promising privacy and end-to-end encryption, the cameras' video transmissions were in part not end-to-end encrypted and in part not encrypted at all, a live video stream could in some cases be accessed without authentication via the relevant URL, and testing processes that could have detected these vulnerabilities were lacking. The companies allegedly pay 450,000 USD in penalties and costs and must regularly substantiate that the manufacturer maintains an information security programme, secure software development, vulnerability management with penetration testing and encryption of the videos.

Authority / court

Office of the New York State Attorney General (Bureau of Internet & Technology)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

New York Executive Law § 63(12); New York General Business Law §§ 349, 350

Action

Fine

Status of proceedings

final

Sector

Retail and e-commerce

Published

28 Jan 2025

Checked against the official source on 4 Oct 2026 · Direct link

When changing data flows for 1099-K tax forms, insufficiently trained teams bypassed security processes; criminals with compromised credentials were able to retrieve forms containing social security numbers. According to the New York State Department of Financial Services (NYDFS), qualified personnel, training, access policies as well as MFA, CAPTCHA and rate limiting were lacking.

Authority / court

New York State Department of Financial Services (NYDFS)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

23 NYCRR Part 500 (Cybersecurity Regulation)

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Employees

10,000 or more

Culpability

negligent

Mitigating circumstances

PayPal has since remedied the deficiencies.

Published

23 Jan 2025

Original amount 2,000,000 USD, converted at the ECB reference rate of 23 Jan 2025.

Checked against the official source on 25 Sep 2026 · Direct link

The U.S. Environmental Protection Agency (EPA, Region 10) imposed a civil penalty of 8,770 USD by consent agreement and final order on the City of Boardman (Oregon), whose drinking water system serves around 4,490 people. According to the EPA, the city had not prepared the risk and resilience assessment and emergency response plan required by the Safe Drinking Water Act on time and had not complied with a 2022 EPA order: at an inspection in April 2024 the assessment was an empty template, and the emergency response plan dated from 2005 and contained no cybersecurity section. The city admitted jurisdiction without admitting or denying the factual allegations and waived its right to appeal. The authority allegedly made the findings set out here; this account is not based on a final judgment.

Authority / court

U.S. Environmental Protection Agency (EPA), Region 10

Area of law

Information security and cyber · Critical infrastructure

Legal basis

Safe Drinking Water Act Section 1433(a) und (b) (42 U.S.C. § 300i-2) sowie Section 1414(g)(3)(A); Strafe nach Section 1414(g)(3)(B) (42 U.S.C. § 300g-3(g)(3)(B))

Action

Fine

Status of proceedings

final

Sector

Energy and utilities

Repeat case

yes

Published

7 Jan 2025

Original amount 8,770 USD, converted at the ECB reference rate of 7 Jan 2025.

Checked against the official source on 3 Oct 2026 · Direct link

According to the Federal Trade Commission (FTC, the US consumer protection authority), three attacks between 2014 and 2020 affected more than 344 million guests worldwide, including 5.25 million unencrypted passport numbers; one intrusion went undetected for 14 months. The FTC alleges inadequate password, access, firewall and segmentation controls, failure to patch, insufficient logging and too little MFA; the order finalised in December 2024 requires a security programme with annual certification to the FTC for 20 years, independent assessments every two years, data minimisation and a deletion option for US customers. In parallel, Marriott pays 52 million USD to 49 states and Washington, D.C.

Authority / court

Federal Trade Commission (FTC)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

Section 5 FTC Act

Action

Order

Status of proceedings

final

Sector

Other

Employees

10,000 or more

Published

20 Dec 2024

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

After a login outage of around 75 minutes on Instagram on 22 March 2024 that affected some 3.35 million users in Korea, Meta Platforms reported the incident only 24 hours and 19 minutes after it began, despite three requests from the Ministry. A report within 10 minutes and a written report within two hours are required; the Ministry imposed an administrative fine of 5,000,000 KRW under the Framework Act on Broadcasting and Communications Development (방송통신발전 기본법). The amount and the facts have not been confirmed against the primary source.

Authority / court

Ministry of Science and ICT (MSIT, 과학기술정보통신부)

Area of law

Information security and cyber · Incident reporting obligations

Legal basis

Framework Act on Broadcasting and Communications Development (방송통신발전 기본법) Art. 38; Basisplan zum Management von Kommunikationsstörungen 2024

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Employees

10,000 or more

Published

28 Nov 2024

Original amount 5,000,000 KRW, converted at the ECB reference rate of 28 Nov 2024.

Checked against the official source on 4 Oct 2026 · Direct link

From late 2020 onwards, attackers obtained non-public data of New Yorkers, above all driver's licence numbers, in several incidents through publicly accessible web applications of the car insurer GEICO – including the quoting portal, the claims website and an interface. The New York State Department of Financial Services (NYDFS) found breaches of the cybersecurity regulation 23 NYCRR Part 500, including inadequate risk assessments, missing monitoring of user activity and incorrect compliance certifications for 2017 to 2021, and imposed a penalty of 5,000,000 USD. In parallel, GEICO pays a further 4,750,000 USD in a separate settlement with the New York Attorney General. The authority allegedly made the findings set out here; this account is not based on a final judgment.

Authority / court

New York State Department of Financial Services (NYDFS)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

23 NYCRR §§ 500.2(b), 500.3(i) und (k), 500.5, 500.8(a), 500.9(a), 500.14(a), 500.17(b); Strafe nach New York Financial Services Law § 408

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Mitigating circumstances

The NYDFS acknowledged the company's cooperation during the investigation and its substantial investment in remediating the shortcomings.

Published

25 Nov 2024

Original amount 5,000,000 USD, converted at the ECB reference rate of 25 Nov 2024.

Checked against the official source on 3 Oct 2026 · Direct link

A US swap trading platform did not fully inform its board of the results of emergency, technology risk and penetration tests, did not regularly test its business continuity and disaster recovery capabilities and had no adequate risk management. It also failed to produce documents requested during an examination on time despite extensions of deadlines; the Commodity Futures Trading Commission (CFTC) imposed 875,000 USD.

Authority / court

Commodity Futures Trading Commission (CFTC)

Area of law

Information security and cyber · Critical infrastructure

Legal basis

Commodity Exchange Act; CFTC-Regeln zu System Safeguards für Swap Execution Facilities

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Original amount 875,000 USD, converted at the ECB reference rate of 1 Oct 2024.

Checked against the official source on 28 Sep 2026 · Version 3 · Company name anonymised since 1 Oct 2026 · Direct link

On 5 July 2024 the ICO issued an (updated) reprimand to a London borough council. According to the reprimand, it followed a ransomware attack that the council became aware of on 11 October 2020: the attacker was able to access and encrypt 440,000 files containing personal data, including special category data, relating to at least 280,000 residents and other people, including staff. According to the ICO's findings, patch management and user account management were inadequate, in breach of Articles 5(1)(f) and 32(1)(b) UK GDPR. The ICO had initially considered a fine but, taking into account its approach to the public sector and the circumstances of the case, decided on a reprimand.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

Art. 5(1)(f) und 32(1)(b) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 5 Jul 2026 · Direct link

The ICO issued a reprimand to a law firm specialising in criminal and military law. According to the ICO's findings, an unknown attacker used valid credentials to get into the firm's cloud server and later published data on the dark web. The incident affected 8,234 people in the UK, 863 of them at high risk because criminal proceedings data was involved. The ICO criticised the lack of multi-factor authentication and of a password policy for the compromised administrator account, and the fact that the firm had not checked since 2012 whether the security measures in its contract with its outsourced IT provider were adequate. It found infringements of Articles 32(1)(b) and 32(1)(d) UK GDPR. The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

Art. 32(1)(b) und 32(1)(d) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Other

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 21 Jun 2026 · Direct link

In April 2021, a third party alerted the group to a vulnerability in its VPN; the group found malicious code that had been inserted but did not inform the legal and compliance officers of its exchange and clearing subsidiaries for days. As a result, the subsidiaries, including a stock exchange, did not immediately report the incident to the U.S. Securities and Exchange Commission (SEC) as required under Regulation SCI; the group paid 10 million USD.

Authority / court

U.S. Securities and Exchange Commission (SEC)

Area of law

Information security and cyber · Incident reporting obligations

Legal basis

Regulation Systems Compliance and Integrity (Regulation SCI), Meldepflichten

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Employees

10,000 or more

Repeat case

yes

Original amount 10,000,000 USD, converted at the ECB reference rate of 22 May 2024.

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 22 May 2026 · Direct link

According to the Dutch Authority for Digital Infrastructure (RDI), a Dutch telecommunications provider did not take the necessary measures from October 2021 to December 2022 to protect data from lawful interception of telecommunications against unauthorised persons: the security plan was inadequate, staff with access had not been sufficiently screened (missing job descriptions, confidentiality declarations, certificates of conduct), and logical and physical access controls were deficient. No actual unauthorised access was found; the fine amounts to 2.25 million EUR.

Authority / court

Rijksinspectie Digitale Infrastructuur (RDI)

Area of law

Information security and cyber · Critical infrastructure

Legal basis

Telecommunicatiewet Art. 15.4; Besluit beveiliging gegevens telecommunicatie (Bbgt) Art. 2, 3, 4, 8

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Mitigating circumstances

Deficiencies remedied after they were identified; no actual unauthorised access found.

Published

22 Oct 2024

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 21 May 2026 · Direct link

According to the complaint of the Federal Trade Commission (FTC, the US consumer protection authority), an attacker exploited weaknesses in the network of the data services provider for companies and non-profit organisations in early 2020 and stole large amounts of unencrypted data, including Social Security and bank account numbers of millions of people; the attack went undetected for three months, the provider informed its customers only after almost two months and misrepresented the extent. The final order requires a comprehensive security programme, a data retention schedule, deletion of data no longer needed and notification of future reportable incidents to the FTC.

Authority / court

Federal Trade Commission (FTC)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

Section 5 FTC Act

Action

Order

Status of proceedings

final

Sector

Telecoms, IT and software

Published

20 May 2024

Checked against the official source on 28 Sep 2026 · Version 3 · Company name anonymised since 20 May 2026 · Direct link

The ICO issued a reprimand to a UK public body. According to the ICO's findings, unknown attackers got into the body's on-premises email server from 24 August 2021 via a chain of known vulnerabilities; the data affected came mainly from the electoral register, with the names and home addresses of around 40 million people. The security patches for these vulnerabilities had been released in April and May 2021 but had not been applied. In addition, an audit found that 178 active accounts could be cracked quickly because their passwords were identical or similar to the initial passwords issued by the service desk. The ICO found infringements of Articles 5(1)(f) and 32(1)(b) UK GDPR. The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

Art. 5(1)(f) und 32(1)(b) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 9 May 2026 · Direct link

A courier consignment containing bank documents (including PESEL numbers, account numbers, login credentials) was stolen and discarded on a housing estate; the supervisory authority learned of it from the media. The bank had informed neither the authority nor the data subjects because it rated the risk as low – it had already been sanctioned in 2022 for failing to notify data subjects.

Authority / court

Prezes Urzędu Ochrony Danych Osobowych (UODO)

Area of law

Information security and cyber · Incident reporting obligations

Legal basis

Art. 33 Abs. 1, Art. 34 Abs. 1 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Employees

10,000 or more

Repeat case

yes

Published

2 Apr 2024

Original amount 1,440,549 PLN, converted at the ECB reference rate of 12 Mar 2024.

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 12 Mar 2026 · Direct link

The bank sent a customer’s contract data to the wrong recipient and only reported the breach one and a half years later, when the supervisory authority made enquiries following a complaint. Given the risk of identity theft, the authority considered that there had been an obligation to notify within 72 hours.

Authority / court

Prezes Urzędu Ochrony Danych Osobowych (UODO)

Area of law

Information security and cyber · Incident reporting obligations

Legal basis

Art. 33 Abs. 1 DSGVO

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Published

2 Apr 2024

Original amount 78,575.4 PLN, converted at the ECB reference rate of 12 Mar 2024.

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 12 Mar 2026 · Direct link

BaFin (German Federal Financial Supervisory Authority) imposed a fine of 50,000 EUR on a German major bank because the bank had given it incorrect information about a major customer-relevant IT security incident affecting its payment services in 2023 and had informed it considerably late. The decision of 8 February 2024 is final.

Authority / court

Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin)

Area of law

Information security and cyber · Incident reporting obligations

Legal basis

§ 64 Abs. 3 Nr. 15 ZAG

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Employees

10,000 or more

Published

18 Mar 2024

Checked against the official source on 2 Oct 2026 · Company name anonymised since 8 Feb 2026 · Direct link

The ICO issued a reprimand to an English multi-academy trust, which runs schools. According to the ICO, an unauthorised third party used compromised credentials to access and encrypt the trust's systems. According to the ICO's findings, appropriate technical measures were missing: the account lockout policy was inadequate and reversible password encryption was enabled, contrary to National Cyber Security Centre recommendations. The ICO found infringements of Articles 5(1)(f) and 32(1)(b) UK GDPR. The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

Art. 5(1)(f) und 32(1)(b) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 7 Dec 2025 · Direct link

An application of the insurer generated links to transaction documents without login and without an expiry date; according to a journalist, by changing the sequential document number, 885 million documents containing, among other things, social security and bank data could be retrieved. Users were told not to send sensitive data, but there were no technical barriers. The penalty was imposed by the New York State Department of Financial Services (NYDFS).

Authority / court

New York State Department of Financial Services (NYDFS)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

23 NYCRR §§ 500.3, 500.7 (Cybersecurity Regulation)

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Culpability

negligent

Original amount 1,000,000 USD, converted at the ECB reference rate of 27 Nov 2023.

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 27 Nov 2025 · Direct link

The CSSF imposed an administrative fine (amende d'ordre) of EUR 444,400 on the credit institution because its internal governance and control over ICT and security risks fell short of the requirements. The fine followed an on-site inspection from October 2022 to June 2023 concerning Art. 5(1bis) LSF (Luxembourg Law on the Financial Sector) and CSSF Circulars 20/750 and 12/552.

Authority / court

Commission de Surveillance du Secteur Financier (CSSF)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

Art. 63-2(1)(d) und (2)(e) Loi modifiée du 5 avril 1993 relative au secteur financier (LSF); verletzt Art. 5(1bis) LSF; Circulaires CSSF 20/750 und 12/552

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Mitigating circumstances

The institution accepted all findings, submitted a detailed action plan and started remediation immediately.

Published

20 Feb 2024

Checked against the official source on 2 Oct 2026 · Company name anonymised since 17 Nov 2025 · Direct link

The ICO issued a reprimand to a UK supplier of construction materials. According to the ICO, on 11 March 2022 a threat actor gained access to the network, deployed ransomware and exfiltrated data, including personal data of 2,022 current and former UK employees (among other things identity documents, bank details and HR records). According to the ICO's findings, access was gained through a subsidiary's remote desktop service that had no multi-factor authentication; in addition, the company had carried out no formal security testing such as vulnerability scanning or penetration testing before the incident, and the attacker exploited a vulnerability that had been public for more than two years. The ICO found infringements of Article 32(1), 32(1)(b) and 32(1)(d) UK GDPR. The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

Art. 32(1), 32(1)(b) und 32(1)(d) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Construction and real estate

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 14 Nov 2025 · Direct link

The ICO issued a reprimand to a UK recruitment company. According to the ICO, an unauthorised third party gained access to its systems twice within twelve months, around 13 March 2022 and around 16 August 2022, probably by SQL injection each time, and exfiltrated data; 13,720 and 4,421 UK individuals respectively were affected, some of them including bank account numbers. According to the ICO's findings, the company knowingly ran unsupported versions of its database and scripting software, used poorly written code without adequate input validation and had insufficient logging, and did not carry out regular security testing. The ICO found infringements of Article 32(1), 32(1)(b) and 32(1)(d) UK GDPR. The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

Art. 32(1), 32(1)(b) und 32(1)(d) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Other

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 19 Oct 2025 · Direct link

The insurer sent a claims settlement confirmation containing name, address, vehicle and claim data by e-mail to an unauthorised person. After an assessment using an online calculator, it rated the risk as low and did not notify; the supervisory authority found that the notification obligation had been breached and treated, among other things, intent and lack of cooperation as aggravating factors.

Authority / court

Prezes Urzędu Ochrony Danych Osobowych (UODO)

Area of law

Information security and cyber · Incident reporting obligations

Legal basis

Art. 33 Abs. 1 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Culpability

intentional

Repeat case

yes

Published

23 Nov 2023

Original amount 103,752 PLN, converted at the ECB reference rate of 18 Oct 2023.

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 18 Oct 2025 · Direct link

The ICO issued a reprimand to a UK business services group. According to the ICO case page, the company suffered a ransomware attack in which personal data was exfiltrated. According to the ICO's findings, there was no clear bring-your-own-device policy and no adequate account lockout policy, and multi-factor authentication had not been set up for the affected user account. As aggravating factors, the ICO noted that data had been kept for longer than necessary and that it took eleven months to notify everyone affected. The ICO found infringements of Articles 5(1)(f) and 32(1) UK GDPR. The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

Art. 5(1)(f) und 32(1) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Financial services and insurance

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 10 Oct 2025 · Direct link

The FCA fined a UK credit reference agency £11,164,400. The FCA found that the agency had outsourced the processing of UK consumer data to its US parent without adequately overseeing the security of that data, even though it knew of problems with security patching. In the 2017 cyber attack on the parent company, data of millions of people in the UK were also taken. In the FCA's view, subsequent public statements on the impact on UK consumers failed to be fair, clear and not misleading. The fine includes a 30% discount.

Authority / court

Financial Conduct Authority (FCA)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

FCA Principles 3, 6 und 7; section 206 FSMA 2000

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Original amount 11,164,400 GBP, converted at the ECB reference rate of 3 Oct 2023.

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 3 Oct 2025 · Direct link

On 23 August 2023 the ICO issued a reprimand to an English city council. According to the ICO's findings, before a ransomware attack the council had no centralised logging or SIEM system; the attacker was able to delete logs, which hampered detection and investigation. After the attack the council did not restore access to personal data in a timely manner, could not identify which individuals were at risk and relied on ad hoc processes to analyse the data, such as downloads over employees' home Wi-Fi networks. The ICO found infringements of Article 32(1)(b), 32(1)(c) and 32(1)(d) UK GDPR. The ICO enforcement list shows the case under 1 September 2023.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

Art. 32(1)(b), 32(1)(c) und 32(1)(d) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 23 Aug 2025 · Direct link

The ICO issued a reprimand to a UK company operating a video platform; its case page lists the reprimand as issued. The published document, however, is worded as a provisional decision, referring to provisional findings and alleged infringements; the ICO has not published a version in final wording. As described by the ICO, around 14 August 2022 an unauthorised person got into the company's systems and copied the names, email addresses and passwords of 345,000 UK users; the company could not say exactly how this happened. The ICO provisionally criticised the company for being unable to show which security measures were in place at the time, or that it carried out regular penetration tests or vulnerability scans, and for relying on assurances from service providers without showing contracts or oversight. It considered that Article 32(1) and 32(1)(d) UK GDPR had been infringed. The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

Art. 32(1) und 32(1)(d) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Media and online platforms

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 25 Jul 2025 · Direct link

The consumer lender allowed local administrators to share accounts and to keep using the default password issued at onboarding, had no formalised methodology for secure software development, did not carry out timely due diligence on high- and medium-risk vendors and did not adjust their risk ratings even after incidents caused by them. The New York State Department of Financial Services (NYDFS) imposed 4.25 million USD; the lender committed to extensive remedial measures.

Authority / court

New York State Department of Financial Services (NYDFS)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

23 NYCRR Part 500 (Cybersecurity Regulation)

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Published

25 May 2023

Original amount 4,250,000 USD, converted at the ECB reference rate of 25 May 2023.

Checked against the official source on 28 Sep 2026 · Version 3 · Company name anonymised since 25 May 2025 · Direct link

Finansinspektionen (Swedish Financial Supervisory Authority) issued a Swedish major bank with a remark (anmärkning) and an administrative fine of 850,000,000 SEK because on 28 April 2022 the bank made a change to a business-critical IT system – to implement new EU sanctions – without following its internal change management process: without approval by the Change Advisory Board, without a risk assessment and without a rollback plan. The resulting error stopped around 1.7 million transactions to about 1.1 million accounts, showed incorrect balances for almost 960,000 customers and prevented around 160,000 customers from making payments; because none of the bank's controls had detected that the process was bypassed, the supervisor found the internal control of this systemically important bank to be inadequate. It treated an earlier sanction from 2020 (oversight of anti-money laundering measures in subsidiary banks) as aggravating and, in the bank's favour, the fact that the breach was neither long-lasting nor systematic.

Authority / court

Finansinspektionen (FI)

Area of law

Information security and cyber · Critical infrastructure

Legal basis

6 kap. 2 § lagen (2004:297) om bank- och finansieringsrörelse (LBF) i. V. m. 2 kap. 1 § första stycket 5 FFFS 2014:1; Anmärkning nach 15 kap. 1 § LBF, Sanktionsavgift nach 15 kap. 7 § LBF

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Employees

10,000 or more

Repeat case

yes

Mitigating circumstances

Not a long-lasting or systematic breach; the bank has taken, and announced further, measures to strengthen internal control.

Published

15 Mar 2023

Original amount 850,000,000 SEK, converted at the ECB reference rate of 14 Mar 2023.

Checked against the official source on 28 Sep 2026 · Company name anonymised since 14 Mar 2025 · Direct link

On 10 March 2023 the ICO issued a reprimand to a UK online trading provider. According to the ICO's findings, on 14 April 2020 an unauthorised third party exploited an unpatched vulnerability in third-party software it used to access the company's systems and exfiltrate 17.92 GB of data; 72,361 UK data subjects were affected, with names, email addresses, bank account numbers and sort codes involved. The company had no patch management programme and was not applying security patches, although its support contract made this its own responsibility. The ICO considered the case under the GDPR as it applied at the time and found infringements of Article 32(1) and 32(1)(b) GDPR.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

Art. 32(1) und 32(1)(b) GDPR; Verwarnung nach Art. 58(2)(b) GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Other

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 10 Mar 2025 · Direct link

On 21 February 2023 the ICO issued a reprimand to a UK financial services professional body; its case page lists the reprimand as issued. The published letter, however, is worded as an announcement and provisional decision ("we intend to issue", "provisionally decided", "alleged infringements"); the ICO has not published a version in final wording. As described by the ICO, on 17 February 2020 an attacker used a known weakness in the website software and a brute-force attack to plant malicious code on the payment page; the code harvested card details of an estimated 3,883 people in the UK, along with names and email addresses, and 654 people reported card fraud. According to the ICO, a forensic investigation commissioned by the body found that it was running unsupported software and that a patch for one critical flaw had been available since 2017; The body said it had not carried out penetration tests before the incident. The ICO provisionally considered that Articles 32(1), 32(1)(b) and 32(1)(d) UK GDPR had been infringed.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

Art. 32(1), 32(1)(b) und 32(1)(d) UK GDPR; Verwarnung nach Art. 58(2)(b) GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Other

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 21 Feb 2025 · Direct link

In response to her access request, a customer received a CD containing call centre conversations of another customer. The provider did not investigate the alert itself but relied on the service provider and asked for the CD to be returned; the authority sanctioned the failure to notify and the failure to comply with the access request.

Authority / court

Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic DPA)

Area of law

Information security and cyber · Incident reporting obligations

Legal basis

Art. 15, Art. 33 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Published

30 Mar 2023

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 20 Feb 2025 · Direct link

For years, the telehealth and discount platform passed its users’ health data to three large advertising and technology companies and other advertising partners and did not notify these unauthorised disclosures as required by the Health Breach Notification Rule. In the first proceedings under this rule, the platform agreed to a civil penalty of 1.5 million USD and a ban on sharing for advertising purposes; the settlement was still subject to court approval.

Authority / court

Federal Trade Commission (FTC) / U.S. Department of Justice

Area of law

Information security and cyber · Incident reporting obligations

Legal basis

FTC Health Breach Notification Rule (16 CFR Part 318); Section 5 FTC Act

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Original amount 1,500,000 USD, converted at the ECB reference rate of 1 Feb 2023.

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 1 Feb 2025 · Direct link

The FTC finalised its order against an online alcohol marketplace. According to the authority, the company had been alerted to security vulnerabilities two years before a data breach in 2020 but still failed to implement basic safeguards, stored critical database information on an unsecured platform and did not monitor for threats; data of around 2.5 million consumers was affected. The marketplace must delete personal data it does not need, tie data collection to a defined retention schedule and introduce an information security programme. Measures against individuals are not set out here. The authority allegedly made the findings set out here; this account is not based on a final judgment.

Authority / court

Federal Trade Commission (FTC)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

Section 5(a) FTC Act, 15 U.S.C. § 45(a) (unlautere und irreführende Praktiken)

Action

Order

Status of proceedings

final

Sector

Retail and e-commerce

Liability of senior managers

Measures against individuals are not set out here.

Published

10 Jan 2023

Checked against the official source on 8 Oct 2026 · Company name anonymised since 9 Jan 2025 · Direct link

Following the migration to a new IT platform in April 2018, customers were able to carry out banking transactions in branches, by telephone and online only to a limited extent for months; all branches and a large proportion of the 5.2 million customers were affected. The Financial Conduct Authority (FCA) and the Prudential Regulation Authority (PRA) accused the bank of deficient planning, governance and management of outsourcing risk and imposed a total of 48.65 million GBP (FCA 29.75 million, PRA 18.9 million).

Authority / court

Financial Conduct Authority (FCA) und Prudential Regulation Authority (PRA)

Area of law

Information security and cyber · Critical infrastructure

Legal basis

FCA- und PRA-Anforderungen an operationelles Risikomanagement, Governance und Auslagerung

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Mitigating circumstances

30% discount for settlement; 32.7 million GBP in compensation already paid to customers.

Original amount 48,650,000 GBP, converted at the ECB reference rate of 20 Dec 2022.

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 20 Dec 2024 · Direct link

The bank reported a significant cyber incident from February 2019 to the ECB not within the prescribed two hours but only 46 hours after the deadline, although it knew of the reporting obligation and the seriousness of the incident; it thereby breached an ECB decision of 23 May 2017. The ECB classified the breach as severe, imposed 3,145,000 EUR and took into account the very active cooperation and the bank's own remedial action as mitigating.

Authority / court

Europäische Zentralbank (EZB), Bankenaufsicht

Area of law

Information security and cyber · Incident reporting obligations

Legal basis

Art. 18 Abs. 7 VO (EU) Nr. 1024/2013; EZB-Beschluss vom 23. Mai 2017 (Meldung erheblicher Cybervorfälle)

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Culpability

intentional

Mitigating circumstances

Very active cooperation with the ECB, own remedial action and prompt handling of the effects of the incident.

Published

16 Dec 2022

Checked against the official source on 28 Sep 2026 · Company name anonymised since 7 Dec 2024 · Direct link

On 19 October 2022 the ICO fined the parent company of a UK construction group GBP 4,400,000. According to the ICO's findings, after a phishing email received on 30 March 2020 was forwarded internally, malware was installed on a workstation on 1 April 2020. The attacker went on to compromise 283 systems and 16 accounts, 12 of them privileged, uninstalled the anti-virus software and encrypted, among other things, four HR databases holding data of up to 113,000 employees, including special category data; according to the ICO, the company identified the incident as a ransomware attack on 2 May 2020. The ICO criticised, among other things, unsupported operating systems, outdated protocols, inadequate endpoint protection, a lack of regular vulnerability scanning and penetration testing, and gaps in training, incident response and privileged account management. It found infringements of Articles 5(1)(f) and 32 GDPR for the period from 18 March 2019 to 1 December 2020. The ICO published the case on 24 October 2022.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

Art. 5(1)(f) und 32 GDPR; Geldbuße nach section 155 DPA 2018 und Art. 83 GDPR

Action

Fine

Status of proceedings

unknown

Sector

Construction and real estate

Original amount 4,400,000 GBP, converted at the ECB reference rate of 19 Oct 2022.

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 19 Oct 2024 · Direct link

Through a phishing attack in July 2020, attackers gained access to an email mailbox that nine employees used with the same login credentials and that was not protected by MFA; it contained six years’ worth of health data of hundreds of thousands of customers, including minors. The New York State Department of Financial Services (NYDFS) also found inadequate data disposal practices, insufficient risk assessments and incorrect compliance certifications for 2018–2021, and imposed 4.5 million USD.

Authority / court

New York State Department of Financial Services (NYDFS)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

23 NYCRR Part 500 (Cybersecurity Regulation)

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Published

18 Oct 2022

Original amount 4,500,000 USD, converted at the ECB reference rate of 18 Oct 2022.

Checked against the official source on 28 Sep 2026 · Version 3 · Company name anonymised since 18 Oct 2024 · Direct link

From 2017 to 2021, the New York futures exchange failed to comply with key system safeguards obligations: no controls testing, inadequate internal and external penetration testing, deficient technology risk assessments without involvement of the board and late notification of a security-relevant system change. In addition, there were reporting violations and a false statement to the Commodity Futures Trading Commission (CFTC); owing to cooperation, the penalty was reduced to 6.5 million USD.

Authority / court

Commodity Futures Trading Commission (CFTC)

Area of law

Information security and cyber · Critical infrastructure

Legal basis

Commodity Exchange Act; CFTC-Regeln zu System Safeguards für Designated Contract Markets

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Mitigating circumstances

Substantial cooperation and remediation; penalty reduced accordingly.

Original amount 6,500,000 USD, converted at the ECB reference rate of 29 Sep 2022.

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 29 Sep 2024 · Direct link