Who was sanctioned, and for what?

The provider of web-based systems for sickness reporting, rehabilitation and occupational safety incidents was hacked in August 2025; the stolen personal data appeared on the dark web shortly afterwards. The Swedish data protection authority (Integritetsskyddsmyndigheten, IMY) found that, despite the high need for protection, there were no adequate security measures and no automatic real-time monitoring for attacks, assessed this as negligent and imposed 1,800,000 SEK.

Authority / court

Integritetsskyddsmyndigheten (IMY)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 32 Abs. 1 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Culpability

negligent

Published

22 Sep 2026

Original amount 1,800,000 SEK, converted at the ECB reference rate of 22 Sep 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

From December 2012 to June 2022, the two companies allocated customers for vehicle tracking and electronic logbook services between themselves and coordinated bids, including in public tenders. At first instance, the Úřad pro ochranu hospodářské soutěže (Czech Office for the Protection of Competition, ÚOHS) fined O2 262.32 million CZK and SHERLOG 18.357 million CZK and imposed a six-month ban on public contracts; for O2, the fine was increased instead of a procurement ban.

Authority / court

Úřad pro ochranu hospodářské soutěže (ÚOHS)

Area of law

Competition law · Cartels and collusion

Legal basis

Tschechisches Wettbewerbsgesetz, Art. 101 AEUV (S0255/2023)

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Culpability

intentional

Published

26 Aug 2026

Original amount 280,677,000 CZK, converted at the ECB reference rate of 26 Aug 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

In two decisions, the European Commission found that Google favours its own services in search (460 million EUR) and prevents app developers on Google Play from steering customers to alternative offers (430 million EUR). Google was ordered to bring the infringements to an end.

Authority / court

Europäische Kommission

Area of law

AI and digital regulation · Platform obligations

Legal basis

Verordnung (EU) 2022/1925 (DMA), Selbstbevorzugungsverbot und Anti-Steering-Pflicht

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Employees

10,000 or more

Published

23 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

A synchronisation error between two applications allowed a customer to retrieve other customers’ invoices in the mobile app; in addition, the ticketing platform, which was publicly accessible without VPN, MFA or IP restriction, was attacked and a very large data set (including copies of identity documents, card data, IBANs) was exfiltrated. The Romanian data protection authority (ANSPDCP) imposed fines of 104,780 lei (20,000 EUR, Art. 25) and 419,120 lei (80,000 EUR, Art. 32), a total of 523,900 lei, and ordered test and change management. Date = publication of the press release; according to the authority, the investigation was concluded in the previous month.

Authority / court

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 25 Abs. 1, Art. 32 Abs. 1 lit. b und d, Abs. 2 und 4 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Published

17 Jul 2026

Original amount 523,900 RON, converted at the ECB reference rate of 17 Jul 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Germany's Federal Financial Supervisory Authority (Bundesanstalt für Finanzdienstleistungsaufsicht, BaFin) imposed a fine of 240,000 EUR on the software company because it had not disclosed the information about a cyberattack it had suffered as inside information without delay. The fine notice is final.

Authority / court

Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin)

Area of law

Capital markets and financial supervision · Disclosure and reporting obligations

Legal basis

Art. 17 Abs. 1 UAbs. 1 MAR (EU) Nr. 596/2014

Action

Fine

Status of proceedings

final

Sector

Telecoms, IT and software

Published

20 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

With the support of a consultancy, the three largest pay-TV providers agreed from 2019 to May 2025 to introduce advertising as a condition for accessing recordings and to standardise the marketing of this advertising space. The Autoridade da Concorrência (Portuguese Competition Authority, AdC) imposed 8,181,000 EUR on three companies; together with the fourth participant, already sanctioned earlier under a settlement, the fines add up to 13,351,000 EUR. Owing to ongoing court proceedings, the AdC did not publish the names in its announcement.

Authority / court

Autoridade da Concorrência (AdC)

Area of law

Competition law · Cartels and collusion

Legal basis

Lei da Concorrência (Lei n.º 19/2012), Art. 9.º (Processo PRC/2020/4)

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Published

5 Jun 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Attackers posed as technical support, induced staff at points of sale to grant system access and obtained data on more than 365,000 customers, including payment data for 41,359 of them. The Italian data protection authority (Garante per la protezione dei dati personali) criticised deficient management of access credentials and digital certificates as well as inadequate security assessments, and imposed 1,715,600 EUR.

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO (Integrität und Vertraulichkeit, Art. 32)

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Published

16 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Following six complaints, the Tietosuojavaltuutetun toimisto (Office of the Data Protection Ombudsman) found that the company did not provide a copy to customers who requested recordings of their sales calls in order to dispute invoices, offering only to let them listen via customer service, and in some cases deleted recordings. In addition to a reprimand, a fine of 5,000 EUR was imposed.

Authority / court

Tietosuojavaltuutetun toimisto – seuraamuskollegio (Datenschutzbeauftragter, Sanktionsgremium)

Area of law

Data protection · Data subject rights and transparency

Legal basis

DSGVO Art. 15 Abs. 1 und 3

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Published

25 Mar 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

From 2008 to 2011, the Paris-based supplier of betting and gaming terminals made unjustified payments of 78,972 EUR to the head of the majority state-owned Pari Mutuel Urbain Mali, with which it had a supply contract awarded without a tender. The case was triggered by a report from TRACFIN (the French financial intelligence unit). Public interest fine of 499,150 EUR (including 335,000 EUR already seized) and a three-year AFA compliance programme.

Authority / court

Parquet national financier (PNF); Validierung durch den Präsidenten des Tribunal judiciaire de Paris

Area of law

Bribery and corruption · Bribery of public officials

Legal basis

Art. 41-1-2 Code de procédure pénale (CJIP); Bestechung ausländischer Amtsträger und Geldwäsche

Action

Fine

Status of proceedings

final

Sector

Telecoms, IT and software

Employees

50 to 249

Culpability

intentional

Liability of senior managers

The CJIP does not address the criminal liability of natural persons.

Published

18 Feb 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The provider of management software and an app for sports clubs suffered a data exfiltration by an external attacker in January 2025. The Swedish Authority for Privacy Protection (IMY) found that no appropriate technical and organisational security measures were in place before and at the time of the incident, even though the data processed related predominantly to children and also included health information (allergies, disabilities), and imposed 6 million SEK; in setting the amount it took into account the 2024 group turnover of the Lime group (around 685.7 million SEK).

Authority / court

Integritetsskyddsmyndigheten (IMY)

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO Art. 32 Abs. 1

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Mitigating circumstances

Prompt and comprehensive information of the clubs and data subjects after the incident; support for around 1,700 clubs in filing their notifications within 72 hours.

Published

26 Jan 2026

Original amount 6,000,000 SEK, converted at the ECB reference rate of 26 Jan 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Following an attack in October 2024 in which data relating to around 24 million customer contracts, including IBANs, was exfiltrated, the French data protection authority (CNIL) imposed 27 million EUR on Free Mobile and 15 million EUR on Free (42 million EUR in total). The authority objected to VPN access without adequate authentication, deficient detection of suspicious access, incomplete notification of data subjects and, at Free Mobile, excessively long retention of old contracts; orders with deadlines were also issued.

Authority / court

Commission nationale de l'informatique et des libertés (CNIL)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5 Abs. 1 lit. e, Art. 32, Art. 34 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Mitigating circumstances

During the proceedings, the companies introduced multi-factor authentication, a Security Operations Centre and improved logging.

Published

14 Jan 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

As a processor, Nexpublica developed and operated the case management software ‘Public CRM’ for the disability authority MDPH Nord. Following two data breaches in 2022, audits revealed critical vulnerabilities that had existed since 2021, such as outdated SHA-1 hashing; the French data protection authority (CNIL) imposed 1.7 million EUR directly on the service provider.

Authority / court

Commission nationale de l'informatique et des libertés (CNIL)

Area of law

Data protection · Data processors

Legal basis

Art. 32 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

In August 2020, the operators of the electronic class registers ‘Tamo’ and ‘Eduka’ agreed to stop competing: one group kept the class register business, the other took over the digital learning content. Following acknowledgement of the infringement, the fines were reduced by 15%: 2,714,940 EUR jointly and severally for the Snowball.xyz group and 913,340 EUR for the AL holdingas group (Art. 101 TFEU). The decision can be appealed. Source: archived copy of the press release.

Authority / court

Konkurencijos taryba (Litauischer Wettbewerbsrat)

Area of law

Competition law · Cartels and collusion

Legal basis

Konkurencijos įstatymas; Art. 101 AEUV

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Mitigating circumstances

Acknowledgement of the infringement (15% reduction)

Published

18 Dec 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

In February 2023, the IT holding company acquired a 50% stake with negative sole control in the Xiaomi distributor Mystical Hungary Zrt., but only approached the Gazdasági Versenyhivatal (Hungarian Competition Authority, GVH) after 582 days and notified the concentration thereafter. Following voluntary disclosure, acknowledgement and waiver of legal remedies, the authority imposed a significantly reduced 32.6 million HUF.

Authority / court

Gazdasági Versenyhivatal (GVH)

Area of law

Competition law · Merger control

Legal basis

Ungarisches Wettbewerbsgesetz, Vollzugsverbot (VJ/20/2025)

Action

Fine

Status of proceedings

final

Sector

Telecoms, IT and software

Culpability

negligent

Mitigating circumstances

Voluntary disclosure, acknowledgement and waiver of legal remedies.

Published

18 Dec 2025

Original amount 32,600,000 HUF, converted at the ECB reference rate of 18 Dec 2025.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The address broker (formerly Kapitol) had passed on the complainant’s data via a media agency to an advertiser for direct marketing without being able to demonstrate valid consent. The Autorité de protection des données (Belgian Data Protection Authority, APD) imposed 40,000 EUR and ordered erasure and information of the recipients; on 3 June 2026 the Cour des marchés (Brussels Market Court) set aside these parts and itself set the fine at 5,000 EUR.

Authority / court

Autorité de protection des données (APD/GBA) – Chambre Contentieuse; Cour des marchés

Area of law

Data protection · Marketing and consent

Legal basis

DSGVO Art. 5 Abs. 1 lit. a, Art. 6 Abs. 1, Art. 24

Action

Fine

Status of proceedings

reduced

Sector

Telecoms, IT and software

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The telecommunications provider allowed a software service provider belonging to the group in Serbia to access the entire SAP CRM customer database with administrator rights, from the end of 2022 without standard contractual clauses and without clear information to customers. The Agencija za zaštitu osobnih podataka (Croatian Personal Data Protection Agency, AZOP) also sanctioned the copying of employees’ identity cards and criminal records certificates and the failure to vet a telemarketing service provider; 4.5 million EUR in total.

Authority / court

Agencija za zaštitu osobnih podataka (AZOP)

Area of law

Data protection · International data transfers

Legal basis

Art. 44, 46, 12 Abs. 1, 13 Abs. 1 lit. f, 5, 6 Abs. 1, 28 Abs. 1 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Published

14 Nov 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

During ongoing tenders for school equipment, Smart Soft sent dozens of identical letters to schools in the Plovdiv/Pazardzhik/Panagyurishte region containing untrue or distorted statements about its competitor Evroklas-konsult. The Комисия за защита на конкуренцията (Bulgarian Commission for the Protection of Competition, KZK) found damage to reputation (Art. 30 ZZK – Bulgarian Protection of Competition Act) over around two months and imposed 3% of 2024 turnover, i.e. 37,410 leva. An appeal has been lodged against the decision.

Authority / court

Комисия за защита на конкуренцията (КЗК, Bulgarische Wettbewerbskommission)

Area of law

Competition law

Legal basis

Art. 30 ZZK (Schädigung des guten Rufs eines Wettbewerbers)

Action

Fine

Status of proceedings

under appeal

Sector

Telecoms, IT and software

Original amount 37,410 BGN, converted at the ECB reference rate of 25 Sep 2025.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Unknown persons accessed the system operator’s databases via several websites and obtained personal data. The Datu valsts inspekcija (Latvian Data State Inspectorate, DVI) initially imposed 400,000 EUR; in the objection procedure, the director set aside the allegation relating to the company’s role as controller because ZZ Dats was a processor, and set the fine at 300,000 EUR for insufficient security measures under Art. 32 GDPR. The company has brought an action.

Authority / court

Datu valsts inspekcija (DVI)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 32 Abs. 1 lit. b und d, Abs. 2, Art. 83 Abs. 4 lit. a DSGVO

Action

Fine

Status of proceedings

under appeal

Sector

Telecoms, IT and software

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Using a customer’s identity card, an unknown person registered at least 15 prepaid numbers in her name at a Vodafone partner shop. By Decision 27/2025, the Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority) imposed on Vodafone 350,000 EUR (processing by a processor, Art. 28), 200,000 EUR (accuracy of data) and 150,000 EUR under the Greek ePrivacy law, and issued a reprimand requiring the company to secure the activation of new numbers technically within three months (for example by sending an SMS to the existing customer); the shop (Karampelas K. & Sia E.E., ‘DS Phone’) received 40,000 EUR.

Authority / court

Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority)

Area of law

Data protection · Data processors

Legal basis

Art. 5 Abs. 1 lit. d, Art. 28 Abs. 1 und 3 DSGVO; Art. 12 Gesetz 3471/2006

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

In 2021, a whistleblower reported payments by subsidiaries in Indonesia, Malaysia, Vietnam, Thailand and India to contractual partners; the investigation concerned private-sector bribery and bribery of foreign public officials. The CJIP provides for a public interest fine of 16,074,511 EUR (including 1 million EUR already seized) and a three-year AFA compliance programme.

Authority / court

Parquet national financier (PNF); Validierung durch das Tribunal judiciaire de Paris

Area of law

Bribery and corruption · Commercial bribery

Legal basis

Art. 41-1-2 Code de procédure pénale (CJIP); Bestechung im privaten Sektor und ausländischer Amtsträger

Action

Fine

Status of proceedings

final

Sector

Telecoms, IT and software

Employees

1,000 to 9,999

Culpability

intentional

Liability of senior managers

The CJIP does not address the criminal liability of natural persons.

Published

19 Jun 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report