Compliance Radar
Who was sanctioned, and for what?
Fines, court rulings and incidents from Europe, North America, Latin America, Asia-Pacific, Middle East and Africa: 2,207 cases from 44 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.
Click a bar to drill down one level.
Where?
by regionAll jurisdictions
What for?
by action- Fine €48.4m 100 % · 15 cases
- Reprimand or warning – 0 % · 12 cases
- Order – 0 % · 4 cases
Who?
by sectorAll sectors
When?
per year, by date of decision| Period | Cases | Total |
|---|---|---|
| 2022 | 2 | €9.63m |
| 2023 | 13 | €18.2m |
| 2024 | 6 | €4.76m |
| 2025 | 6 | €12m |
| 2026 | 4 | €3.86m |
31 cases
5 Aug 2026 Order Express, Inc.NYDFS: $250,000 against money transmitter Order Express over cyber deficiencies €216,375
The licensed money transmitter had no adequate policies for system updates and insufficient risk assessments under New York's cybersecurity regulation, as found by the New York State Department of Financial Services (NYDFS). The company has already remedied the deficiencies.
Even small financial service providers must keep documented patch policies and regular risk assessments.
- Authority / court
- New York State Department of Financial Services (NYDFS)
- Area of law
- Information security and cyber · Security measures and risk management
- Legal basis
- 23 NYCRR Part 500 (Cybersecurity Regulation)
- Action
- Fine
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Mitigating circumstances
- Because of its low turnover, the company was exempt from many Part 500 obligations; deficiencies already remedied.
- Published
- 5 Aug 2026
Original amount 250,000 USD, converted at the ECB reference rate of 5 Aug 2026.
- New York State Department of Financial Services Secures Cybersecurity Settlement with Order Express, Inc. Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
28 Jul 2026 Luk Fook Securities (HK) LimitedLuk Fook Securities: HKD 2.1m fine for weak cybersecurity ahead of ransomware attack €235,595
Luk Fook Securities (HK) was publicly reprimanded and fined 2,100,000 HKD because inadequate cybersecurity controls might have contributed to a ransomware attack on 19 September 2022 hitting numerous core servers and to full recovery taking until 7 October 2022; during that time clients could not trade via the app or internet platform. Findings included missing firewall protection, outdated operating systems and antivirus software, weak access and password controls with credentials stored unencrypted, insufficient controls over remote access and external devices, inadequate data backup and a last security training session in 2018.
Basic cyber hygiene – patching, access and password controls, backups and regular staff training – is a regulatory obligation for financial firms.
Ransomware defence, password security and security awareness training
Missing or inadequate training played a role in the decision.
- Authority / court
- Securities and Futures Commission (SFC)
- Area of law
- Information security and cyber · Security measures and risk management
- Legal basis
- s. 194 SFO (Cap. 571); Code of Conduct GP 2, GP 3, GP 7, paras. 12.1, 18.5 und Schedule 7; Guidelines for Reducing and Mitigating Hacking Risks Associated with Internet Trading
- Action
- Fine
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Repeat case
- no
- Mitigating circumstances
- Root-cause review with an independent reviewer, strengthened controls, no evidence of client loss, cooperation, clean disciplinary record.
- Published
- 28 Jul 2026
Original amount 2,100,000 HKD, converted at the ECB reference rate of 28 Jul 2026.
- SFC press release 26PR118: SFC reprimands and fines Luk Fook Securities (HK) Limited $2.1 million for inadequate cybersecurity control (28.07.2026) Press release of an authority
- SFC Statement of Disciplinary Action zu 26PR118 Decision of an authority
Checked against the official source on 3 Oct 2026 · Direct link
Report an error
29 Apr 2026 Delta Dental Insurance Company und Delta Dental of New York, Inc.NYDFS: $2.25 million against Delta Dental after MOVEit attack and late notification €1.92m
In 2023, attackers exploited a zero-day vulnerability in MOVEit Transfer to steal files containing social security, driving licence, account and health data. The New York State Department of Financial Services (NYDFS) criticised inadequate retention settings, policies and controls as well as the late notification of the cybersecurity incidents to the supervisory authority.
Keep data in transfer tools only for as long as necessary – and report security incidents to the supervisory authority on time.
- Authority / court
- New York State Department of Financial Services (NYDFS)
- Area of law
- Information security and cyber · Security measures and risk management
- Legal basis
- 23 NYCRR Part 500 (Cybersecurity Regulation)
- Action
- Fine
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Culpability
- negligent
- Published
- 30 Apr 2026
Original amount 2,250,000 USD, converted at the ECB reference rate of 29 Apr 2026.
- DFS Secures $2.25 Million Cybersecurity Settlement with Delta Dental Press release of an authority
- Consent Order to Delta Dental 2026 Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
9 Feb 2026 FIIG Securities LimitedFIIG Securities: 2.5 million AUD for inadequate cyber security ahead of data theft €1.48m
The Federal Court of Australia, on application by the Australian Securities and Investments Commission (ASIC, Australia's corporate, markets and financial services regulator), imposed a penalty of 2.5 million AUD on the fixed-income specialist because between March 2019 and June 2023 it lacked adequate cyber security measures, resources and risk management systems – among other things, there was no multi-factor authentication for remote access, no regular penetration testing and no mandatory security awareness training. In a 2023 attack around 385 GB of confidential data were stolen and some 18,000 clients were notified; the court also ordered a compliance programme with an independent expert.
For licensed financial services firms, cyber security is part of their licence obligations: basic measures such as MFA, patching, monitoring, training and a tested incident response plan must be funded and actually implemented.
Cyber security basics: multi-factor authentication, patch management, security awareness training, tested incident response plan
Missing or inadequate training played a role in the decision.
- Authority / court
- Federal Court of Australia (auf Antrag der Australian Securities and Investments Commission, ASIC)
- Area of law
- Information security and cyber · Security measures and risk management
- Legal basis
- Corporations Act 2001 (Cth) s 912A(1)(a), (d) und (h) i. V. m. s 912A(5A)
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Financial services and insurance
- Repeat case
- no
- Mitigating circumstances
- Full cooperation, admissions and an agreed statement of facts; no previous contraventions; the known financial losses (remediation costs of around 1.5 million AUD) were largely borne by the company itself.
- Published
- 9 Feb 2026
Original amount 2,500,000 AUD, converted at the ECB reference rate of 9 Feb 2026.
Checked against the official source on 3 Oct 2026 · Direct link
Report an error
14 Oct 2025 Farmers Insurance ExchangeNYDFS: $2.775 million against Farmers over unprotected online quoting tools €2.4m
Attackers harvested driving licence numbers and dates of birth via inadequately secured online quoting tools and agent portals. According to the New York State Department of Financial Services (NYDFS), Farmers infringed the cybersecurity regulation and did not report the incident in time; the penalty is part of a package totalling $19 million against eight motor insurers.
Automatically pre-filled forms containing customer data are a point of entry – scrutinise public-facing applications for the data they disclose.
- Authority / court
- New York State Department of Financial Services (NYDFS)
- Area of law
- Information security and cyber · Security measures and risk management
- Legal basis
- 23 NYCRR Part 500 (Cybersecurity Regulation)
- Action
- Fine
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Culpability
- negligent
- Published
- 14 Oct 2025
Original amount 2,775,000 USD, converted at the ECB reference rate of 14 Oct 2025.
- DFS Secures More than $19 Million from Auto Insurance Companies over Data Breaches Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
22 Sep 2025 Nova Ljubljanska banka d. d.NLB: reprimand because PSD2 interface exposed 57 account numbers Reprimand or warning
After an update of the PSD2 interface for third-party providers in July 2023, the confidentiality of 57 IBAN accounts of bank customers was not ensured. The banking supervisor, Banka Slovenije (Bank of Slovenia), issued a reprimand to the bank for breaching the obligation to protect confidential data (final).
Every change to customer interfaces requires testing for data leakage before go-live.
Security testing for software releases of interfaces
- Authority / court
- Banka Slovenije
- Area of law
- Information security and cyber · Security measures and risk management
- Legal basis
- Art. 146, Art. 396 Abs. 1 Nr. 18 ZBan-3 (slowenisches Bankengesetz)
- Action
- Reprimand or warning
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Liability of senior managers
- Measures against individuals are not reported here.
- Banka Slovenije, Veröffentlichung der Sanktion gegen Nova Ljubljanska banka d. d. (Entscheidung 2025) Decision of an authority
- Banka Slovenije – Informacije o izrečenih ukrepih Enforcement database of an authority
Checked against the official source on 28 Sep 2026 · Version 3 · Direct link
Report an error
23 May 2025 S-Pankki OyjS-Pankki: EUR 7.67m and public warning over faulty banking software €7.67m
The Finanssivalvonta (FIN-FSA, Finnish Financial Supervisory Authority) imposed a joint penalty payment of 7,670,000 EUR on S-Pankki Oyj for failings in operational risk management and additionally issued a public warning. A programming error that was live in a bank system from 20 April to 5 August 2022 had not been adequately tested beforehand; the bank lacked a sufficiently secure system and effective incident management and was insufficiently prepared for outsourcing risks. The warning concerns the failure to apply the required strong customer authentication and payments executed without the payers' consent from 6 May to 5 August 2022; earlier penalty payments imposed on the bank by the supervisor (2019 and 2021) increased the amount. The decision is not final.
Changes to authentication and payment processing need documented testing before going live – even when a service provider develops the software.
Testing and change management for security-critical banking software
- Authority / court
- Finanssivalvonta (FIN-FSA)
- Area of law
- Information security and cyber · Security measures and risk management
- Legal basis
- Luottolaitostoiminnasta annettu laki 9 luku 16 § (1, 2 und 4 mom.) mit MOK 8/2014; FivaL 40 §, 41 §, 41 b §; öffentliche Verwarnung nach FivaL 39 § wegen Maksupalvelulaki 85 c § 1 mom. und 38 § 1 mom.
- Action
- Fine
- Status of proceedings
- under appeal
- Sector
- Financial services and insurance
- Repeat case
- yes
- Mitigating circumstances
- Measures to prevent recurrence and cooperation with the supervisor in the investigation reduced the amount.
- Published
- 23 May 2025
- Finanssivalvonta: S-Pankki Oyj:lle 7 670 000 euron yhteinen seuraamusmaksu ja julkinen varoitus (23./26.05.2025) Press release of an authority
- Finanssivalvonta: Toimituskirja johtokunnan päätöksestä 23.5.2025, FIVA/2024/1181 Decision of an authority
- Finanssivalvonta: Finanssivalvonnan päätökset (Lainvoimaisuus: S-Pankki hat beim Verwaltungsgericht Helsinki Beschwerde eingelegt) Enforcement database of an authority
Checked against the official source on 28 Sep 2026 · Direct link
Report an error
21 May 2025 GoDaddy Inc.FTC: GoDaddy must set up an information security programme after hosting security gaps Order
According to the Federal Trade Commission (FTC, the US consumer protection authority), the web host did not use multi-factor authentication for its hosting services, monitored security threats inadequately and did not secure connections to customer data, yet advertised “award-winning security”. The final order prohibits false statements about security and requires a comprehensive information security programme and regular reviews by independent assessors.
Be able to prove basics such as MFA and threat monitoring before advertising security – otherwise the advertising promise itself becomes the violation.
MFA, monitoring and honest security promises
- Authority / court
- Federal Trade Commission (FTC)
- Area of law
- Information security and cyber · Security measures and risk management
- Legal basis
- Section 5 FTC Act
- Action
- Order
- Status of proceedings
- final
- Sector
- Telecoms, IT and software
- Published
- 21 May 2025
- FTC Finalizes Order with GoDaddy over Data Security Failures Press release of an authority
- FTC Takes Action Against GoDaddy for Alleged Lax Data Security for Its Website Hosting Services Press release of an authority
Checked against the official source on 28 Sep 2026 · Direct link
Report an error
24 Jan 2025 Fantasia Trading LLC, Power Mobile Life LLC und Smart Innovation, LLC (Vertrieb der Marke eufy)eufy cameras: 450,000 USD in New York over unencrypted video streams Fine
The New York Attorney General's office concluded an Assurance of Discontinuance with three US distribution companies of the eufy home security brand. Contrary to advertising promising privacy and end-to-end encryption, the cameras' video transmissions were in part not end-to-end encrypted and in part not encrypted at all, a live video stream could in some cases be accessed without authentication via the relevant URL, and testing processes that could have detected these vulnerabilities were lacking. The companies allegedly pay 450,000 USD in penalties and costs and must regularly substantiate that the manufacturer maintains an information security programme, secure software development, vulnerability management with penetration testing and encryption of the videos.
A company that advertises encryption and privacy must be able to back this up with regular security testing – even as a distributor of a manufacturer's products.
Substantiating security claims in advertising; security testing of connected devices
Missing or inadequate training played a role in the decision.
- Authority / court
- Office of the New York State Attorney General (Bureau of Internet & Technology)
- Area of law
- Information security and cyber · Security measures and risk management
- Legal basis
- New York Executive Law § 63(12); New York General Business Law §§ 349, 350
- Action
- Fine
- Status of proceedings
- final
- Sector
- Retail and e-commerce
- Published
- 28 Jan 2025
- NYAG, In the Matter of Fantasia Trading LLC, Power Mobile Life LLC and Smart Innovation, LLC, Assurance of Discontinuance No. 24-103 (wirksam 24.01.2025) Decision of an authority
- NYAG-Pressemitteilung: Attorney General James Secures $450,000 from Companies Selling Home Security Cameras that Failed to Secure Private Videos (28.01.2025) Press release of an authority
Checked against the official source on 4 Oct 2026 · Direct link
Report an error
23 Jan 2025 PayPal, Inc.NYDFS: $2 million against PayPal over untrained teams and missing MFA €1.92m
When changing data flows for 1099-K tax forms, insufficiently trained teams bypassed security processes; criminals with compromised credentials were able to retrieve forms containing social security numbers. According to the New York State Department of Financial Services (NYDFS), qualified personnel, training, access policies as well as MFA, CAPTCHA and rate limiting were lacking.
Anyone changing data flows must know the security processes – training development teams is part of cyber defence.
Secure software development and change processes
Missing or inadequate training played a role in the decision.
- Authority / court
- New York State Department of Financial Services (NYDFS)
- Area of law
- Information security and cyber · Security measures and risk management
- Legal basis
- 23 NYCRR Part 500 (Cybersecurity Regulation)
- Action
- Fine
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Employees
- 10,000 or more
- Culpability
- negligent
- Mitigating circumstances
- PayPal has since remedied the deficiencies.
- Published
- 23 Jan 2025
Original amount 2,000,000 USD, converted at the ECB reference rate of 23 Jan 2025.
- DFS-Pressemitteilung vom 23.01.2025: Cybersecurity-Vergleich mit PayPal, Inc. (2 Mio. $) Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
20 Dec 2024 Marriott International, Inc. und Starwood Hotels & Resorts Worldwide LLCFTC: Marriott and Starwood must upgrade security after three data breaches affecting 344 million people Order
According to the Federal Trade Commission (FTC, the US consumer protection authority), three attacks between 2014 and 2020 affected more than 344 million guests worldwide, including 5.25 million unencrypted passport numbers; one intrusion went undetected for 14 months. The FTC alleges inadequate password, access, firewall and segmentation controls, failure to patch, insufficient logging and too little MFA; the order finalised in December 2024 requires a security programme with annual certification to the FTC for 20 years, independent assessments every two years, data minimisation and a deletion option for US customers. In parallel, Marriott pays 52 million USD to 49 states and Washington, D.C.
Review the security of acquired systems before and immediately after closing – an acquisition brings its legacy IT problems with it.
Patching, network segmentation and MFA after company acquisitions
- Authority / court
- Federal Trade Commission (FTC)
- Area of law
- Information security and cyber · Security measures and risk management
- Legal basis
- Section 5 FTC Act
- Action
- Order
- Status of proceedings
- final
- Sector
- Other
- Employees
- 10,000 or more
- Published
- 20 Dec 2024
- FTC Takes Action Against Marriott and Starwood Over Multiple Data Breaches Press release of an authority
- FTC Finalizes Order with Marriott and Starwood Requiring Them to Implement a Robust Data Security Program to Address Security Failures Press release of an authority
- Marriott International, Inc. and Starwood Hotels & Resorts Worldwide, LLC, In the Matter of Enforcement database of an authority
Checked against the official source on 28 Sep 2026 · Version 2 · Direct link
Report an error
25 Nov 2024 Government Employees Insurance Company (GEICO)GEICO: 5 million USD from NYDFS over cyberattacks on quoting and claims portals €4.76m
From late 2020 onwards, attackers obtained non-public data of New Yorkers, above all driver's licence numbers, in several incidents through publicly accessible web applications of the car insurer GEICO – including the quoting portal, the claims website and an interface. The New York State Department of Financial Services (NYDFS) found breaches of the cybersecurity regulation 23 NYCRR Part 500, including inadequate risk assessments, missing monitoring of user activity and incorrect compliance certifications for 2017 to 2021, and imposed a penalty of 5,000,000 USD. In parallel, GEICO pays a further 4,750,000 USD in a separate settlement with the New York Attorney General. The authority allegedly made the findings set out here; this account is not based on a final judgment.
After an incident it is not enough to close the one gap – all publicly accessible applications need to be reassessed, especially once the industry has been warned.
Security of publicly accessible web applications; responding to industry alerts
- Authority / court
- New York State Department of Financial Services (NYDFS)
- Area of law
- Information security and cyber · Security measures and risk management
- Legal basis
- 23 NYCRR §§ 500.2(b), 500.3(i) und (k), 500.5, 500.8(a), 500.9(a), 500.14(a), 500.17(b); Strafe nach New York Financial Services Law § 408
- Action
- Fine
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Mitigating circumstances
- The NYDFS acknowledged the company's cooperation during the investigation and its substantial investment in remediating the shortcomings.
- Published
- 25 Nov 2024
Original amount 5,000,000 USD, converted at the ECB reference rate of 25 Nov 2024.
- NYDFS, In the Matter of Government Employees Insurance Company, Consent Order (so ordered 25.11.2024) Decision of an authority
- NYDFS-Pressemitteilung: Attorney General James and DFS Superintendent Harris Secure $11.3 Million from Auto Insurance Companies over Data Breaches (25.11.2024) Press release of an authority
Checked against the official source on 3 Oct 2026 · Direct link
Report an error
5 Jul 2024 a London borough councilICO: reprimand for London borough council after a ransomware attack Reprimand or warning
On 5 July 2024 the ICO issued an (updated) reprimand to a London borough council. According to the reprimand, it followed a ransomware attack that the council became aware of on 11 October 2020: the attacker was able to access and encrypt 440,000 files containing personal data, including special category data, relating to at least 280,000 residents and other people, including staff. According to the ICO's findings, patch management and user account management were inadequate, in breach of Articles 5(1)(f) and 32(1)(b) UK GDPR. The ICO had initially considered a fine but, taking into account its approach to the public sector and the circumstances of the case, decided on a reprimand.
- Authority / court
- Information Commissioner's Office (ICO)
- Area of law
- Information security and cyber · Security measures and risk management
- Legal basis
- Art. 5(1)(f) und 32(1)(b) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR
- Action
- Reprimand or warning
- Status of proceedings
- unknown
- Sector
- Public sector
- ICO, Übersicht der Durchsetzungsmaßnahmen (Entscheidung 2024) Enforcement database of an authority
Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 5 Jul 2026 · Direct link
Report an error
21 Jun 2024 a UK law firmICO: reprimand for law firm after a data leak without multi-factor authentication Reprimand or warning
The ICO issued a reprimand to a law firm specialising in criminal and military law. According to the ICO's findings, an unknown attacker used valid credentials to get into the firm's cloud server and later published data on the dark web. The incident affected 8,234 people in the UK, 863 of them at high risk because criminal proceedings data was involved. The ICO criticised the lack of multi-factor authentication and of a password policy for the compromised administrator account, and the fact that the firm had not checked since 2012 whether the security measures in its contract with its outsourced IT provider were adequate. It found infringements of Articles 32(1)(b) and 32(1)(d) UK GDPR. The reprimand is undated; the date follows the ICO case page.
- Authority / court
- Information Commissioner's Office (ICO)
- Area of law
- Information security and cyber · Security measures and risk management
- Legal basis
- Art. 32(1)(b) und 32(1)(d) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR
- Action
- Reprimand or warning
- Status of proceedings
- unknown
- Sector
- Other
- ICO, Übersicht der Durchsetzungsmaßnahmen (Entscheidung 2024) Enforcement database of an authority
Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 21 Jun 2026 · Direct link
Report an error
20 May 2024 a US data services providerFTC: US data services provider must delete legacy data and strengthen security after hacker attack Order
According to the complaint of the Federal Trade Commission (FTC, the US consumer protection authority), an attacker exploited weaknesses in the network of the data services provider for companies and non-profit organisations in early 2020 and stole large amounts of unencrypted data, including Social Security and bank account numbers of millions of people; the attack went undetected for three months, the provider informed its customers only after almost two months and misrepresented the extent. The final order requires a comprehensive security programme, a data retention schedule, deletion of data no longer needed and notification of future reportable incidents to the FTC.
Set retention periods and deletion routines as security measures – data that is no longer needed is pure risk in an attack.
Data minimisation, encryption and honest incident communication
- Authority / court
- Federal Trade Commission (FTC)
- Area of law
- Information security and cyber · Security measures and risk management
- Legal basis
- Section 5 FTC Act
- Action
- Order
- Status of proceedings
- final
- Sector
- Telecoms, IT and software
- Published
- 20 May 2024
- FTC, Pressemitteilungen (Übersicht) (Entscheidung 2024) Press release of an authority
Checked against the official source on 28 Sep 2026 · Version 3 · Company name anonymised since 20 May 2026 · Direct link
Report an error
9 May 2024 a UK public bodyICO: reprimand for UK public body after an attack on its email server Reprimand or warning
The ICO issued a reprimand to a UK public body. According to the ICO's findings, unknown attackers got into the body's on-premises email server from 24 August 2021 via a chain of known vulnerabilities; the data affected came mainly from the electoral register, with the names and home addresses of around 40 million people. The security patches for these vulnerabilities had been released in April and May 2021 but had not been applied. In addition, an audit found that 178 active accounts could be cracked quickly because their passwords were identical or similar to the initial passwords issued by the service desk. The ICO found infringements of Articles 5(1)(f) and 32(1)(b) UK GDPR. The reprimand is undated; the date follows the ICO case page.
- Authority / court
- Information Commissioner's Office (ICO)
- Area of law
- Information security and cyber · Security measures and risk management
- Legal basis
- Art. 5(1)(f) und 32(1)(b) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR
- Action
- Reprimand or warning
- Status of proceedings
- unknown
- Sector
- Public sector
- ICO, Übersicht der Durchsetzungsmaßnahmen (Entscheidung 2024) Enforcement database of an authority
Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 9 May 2026 · Direct link
Report an error
7 Dec 2023 an English multi-academy trustICO: reprimand for multi-academy trust after an attack using compromised credentials Reprimand or warning
The ICO issued a reprimand to an English multi-academy trust, which runs schools. According to the ICO, an unauthorised third party used compromised credentials to access and encrypt the trust's systems. According to the ICO's findings, appropriate technical measures were missing: the account lockout policy was inadequate and reversible password encryption was enabled, contrary to National Cyber Security Centre recommendations. The ICO found infringements of Articles 5(1)(f) and 32(1)(b) UK GDPR. The reprimand is undated; the date follows the ICO case page.
- Authority / court
- Information Commissioner's Office (ICO)
- Area of law
- Information security and cyber · Security measures and risk management
- Legal basis
- Art. 5(1)(f) und 32(1)(b) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR
- Action
- Reprimand or warning
- Status of proceedings
- unknown
- Sector
- Public sector
- ICO, Übersicht der Durchsetzungsmaßnahmen (Entscheidung 2023) Enforcement database of an authority
Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 7 Dec 2025 · Direct link
Report an error
27 Nov 2023 a US title insurerNYDFS: $1 million against US title insurer over open document links €913,159
An application of the insurer generated links to transaction documents without login and without an expiry date; according to a journalist, by changing the sequential document number, 885 million documents containing, among other things, social security and bank data could be retrieved. Users were told not to send sensitive data, but there were no technical barriers. The penalty was imposed by the New York State Department of Financial Services (NYDFS).
Instructions to users do not replace technical controls – sharing links need authentication and an expiry date.
Classification and sending of sensitive documents
- Authority / court
- New York State Department of Financial Services (NYDFS)
- Area of law
- Information security and cyber · Security measures and risk management
- Legal basis
- 23 NYCRR §§ 500.3, 500.7 (Cybersecurity Regulation)
- Action
- Fine
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Culpability
- negligent
Original amount 1,000,000 USD, converted at the ECB reference rate of 27 Nov 2023.
- NYDFS, Newsroom (Übersicht) (Entscheidung 2023) Decision of an authority
Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 27 Nov 2025 · Direct link
Report an error
17 Nov 2023 a Luxembourg credit institutionLuxembourg credit institution: EUR 444,400 for IT governance failings €444,400
The CSSF imposed an administrative fine (amende d'ordre) of EUR 444,400 on the credit institution because its internal governance and control over ICT and security risks fell short of the requirements. The fine followed an on-site inspection from October 2022 to June 2023 concerning Art. 5(1bis) LSF (Luxembourg Law on the Financial Sector) and CSSF Circulars 20/750 and 12/552.
IT and security risks need their own documented governance and control framework; the supervisor sanctions gaps in it as a breach in their own right.
ICT governance and control of IT and security risks
- Authority / court
- Commission de Surveillance du Secteur Financier (CSSF)
- Area of law
- Information security and cyber · Security measures and risk management
- Legal basis
- Art. 63-2(1)(d) und (2)(e) Loi modifiée du 5 avril 1993 relative au secteur financier (LSF); verletzt Art. 5(1bis) LSF; Circulaires CSSF 20/750 und 12/552
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Financial services and insurance
- Mitigating circumstances
- The institution accepted all findings, submitted a detailed action plan and started remediation immediately.
- Published
- 20 Feb 2024
- CSSF, Sanction administrative du 17 novembre 2023 (Mizuho Trust & Banking (Luxembourg) S.A.) Decision of an authority
Checked against the official source on 2 Oct 2026 · Company name anonymised since 17 Nov 2025 · Direct link
Report an error
14 Nov 2023 a UK construction materials supplierICO: reprimand for construction materials supplier after a ransomware attack via remote access without MFA Reprimand or warning
The ICO issued a reprimand to a UK supplier of construction materials. According to the ICO, on 11 March 2022 a threat actor gained access to the network, deployed ransomware and exfiltrated data, including personal data of 2,022 current and former UK employees (among other things identity documents, bank details and HR records). According to the ICO's findings, access was gained through a subsidiary's remote desktop service that had no multi-factor authentication; in addition, the company had carried out no formal security testing such as vulnerability scanning or penetration testing before the incident, and the attacker exploited a vulnerability that had been public for more than two years. The ICO found infringements of Article 32(1), 32(1)(b) and 32(1)(d) UK GDPR. The reprimand is undated; the date follows the ICO case page.
- Authority / court
- Information Commissioner's Office (ICO)
- Area of law
- Information security and cyber · Security measures and risk management
- Legal basis
- Art. 32(1), 32(1)(b) und 32(1)(d) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR
- Action
- Reprimand or warning
- Status of proceedings
- unknown
- Sector
- Construction and real estate
- ICO, Übersicht der Durchsetzungsmaßnahmen (Entscheidung 2023) Enforcement database of an authority
Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 14 Nov 2025 · Direct link