Who was sanctioned, and for what?

The provider of web-based systems for sickness reporting, rehabilitation and occupational safety incidents was hacked in August 2025; the stolen personal data appeared on the dark web shortly afterwards. The Swedish data protection authority (Integritetsskyddsmyndigheten, IMY) found that, despite the high need for protection, there were no adequate security measures and no automatic real-time monitoring for attacks, assessed this as negligent and imposed 1,800,000 SEK.

Authority / court

Integritetsskyddsmyndigheten (IMY)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 32 Abs. 1 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Culpability

negligent

Published

22 Sep 2026

Original amount 1,800,000 SEK, converted at the ECB reference rate of 22 Sep 2026.

Checked against the official source on 25 Sep 2026 · Direct link

From December 2012 to June 2022, the two companies allocated customers for vehicle tracking and electronic logbook services between themselves and coordinated bids, including in public tenders. At first instance, the Úřad pro ochranu hospodářské soutěže (Czech Office for the Protection of Competition, ÚOHS) fined O2 262.32 million CZK and SHERLOG 18.357 million CZK and imposed a six-month ban on public contracts; for O2, the fine was increased instead of a procurement ban.

Authority / court

Úřad pro ochranu hospodářské soutěže (ÚOHS)

Area of law

Competition law · Cartels and collusion

Legal basis

Tschechisches Wettbewerbsgesetz, Art. 101 AEUV

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Culpability

intentional

Published

26 Aug 2026

Original amount 280,677,000 CZK, converted at the ECB reference rate of 26 Aug 2026.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

Through a software vulnerability in a mail platform developed by KDDI and provided to several internet service providers, unauthorised parties obtained the credentials (email address and password) of 12,231,954 people; 7,616,173 passwords were stored in plain text, so mailboxes could be read (discovered on 17 June 2026). The authority gave KDDI guidance (shidō) under Art. 147 APPI to improve its technical security measures because access controls against attackers spreading through the system had been inadequate, required a report by 19 October 2026 and also gave such guidance to individual providers responsible for the plain-text storage.

Authority / court

Personal Information Protection Commission (PPC, 個人情報保護委員会)

Area of law

Data protection · Data breaches and data security

Legal basis

Act on the Protection of Personal Information (APPI, 個人情報の保護に関する法律) Art. 147, Art. 146 Abs. 1

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Telecoms, IT and software

Employees

10,000 or more

Published

19 Aug 2026

Checked against the official source on 4 Oct 2026 · Direct link

The Bundeskartellamt (Federal Cartel Office) declared binding commitments by Apple on its App Tracking Transparency Framework (ATTF), closing its proceedings under Section 19a(2) of the German Competition Act (GWB) and Article 102 TFEU. According to the preliminary assessment, third-party apps had to obtain, for personalised advertising, an additional and more off-putting consent prompt prescribed by Apple, while Apple used a prompt of its own for its own services; in future the prompts will be aligned so that content, wording and design are neutral, and app providers will be able to combine the required prompts more easily.

Authority / court

Bundeskartellamt

Area of law

Competition law · Abuse of market power

Legal basis

§ 19a Abs. 2 GWB, Art. 102 AEUV (Verpflichtungszusagen, Az. B7-54/25)

Action

Order

Status of proceedings

unknown

Sector

Telecoms, IT and software

Employees

10,000 or more

Published

17 Aug 2026

Checked against the official source on 2 Oct 2026 · Direct link

Attackers copied certificates from lost femtocells of KT Corporation into home-made devices, stayed connected to the mobile network undetected for around eleven months, intercepted data on 16,647 subscribers (phone number, IMSI, IMEI) and used intercepted confirmation codes to trigger unauthorised mobile payments of around 240 million KRW affecting 368 people. For inadequate access control – certificates valid for ten years, no IP restriction, no detection of unknown cell IDs – the authority imposed a penalty surcharge of 53,979,000,000 KRW and ordered vulnerability checks and a stronger role for the chief privacy officer.

Authority / court

Personal Information Protection Commission (PIPC, 개인정보보호위원회)

Area of law

Data protection · Data breaches and data security

Legal basis

Personal Information Protection Act (개인정보 보호법) Art. 29, Sanktion nach Art. 64-2(1) Nr. 9; gesonderter Beschluss 제2026-015-094호: Art. 63(1)

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Culpability

negligent

Mitigating circumstances

Reduction of 30% because no benefit was derived and a further 50% for cooperation, remediation, compensation of those affected and protective efforts; increase of 50% because the infringement lasted more than two years.

Liability of senior managers

The company was ordered to define the responsibility and role of its chief privacy officer (CPO) for the whole company clearly and to revise its governance.

Published

30 Jul 2026

Original amount 53,979,000,000 KRW, converted at the ECB reference rate of 29 Jul 2026.

Checked against the official source on 4 Oct 2026 · Direct link

In two decisions, the European Commission found that Google favours its own services in search (460 million EUR) and prevents app developers on Google Play from steering customers to alternative offers (430 million EUR). Google was ordered to bring the infringements to an end.

Authority / court

Europäische Kommission

Area of law

AI and digital regulation · Platform obligations

Legal basis

Verordnung (EU) 2022/1925 (DMA), Selbstbevorzugungsverbot und Anti-Steering-Pflicht

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Employees

10,000 or more

Published

23 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

The Garante (Italian data protection authority) fined TIM 9,516,000 EUR because call centres outside the official sales network made promotional calls on the company's behalf using numbers not recorded in the operators' register ROC or falsified numbers (spoofing), often to lines entered in the do-not-call register, and the contacts obtained in this way reached its systems as apparently lawful leads via fictitious call-back requests on sales partners' web forms. The authority found that TIM had selected and supervised its sales partners inadequately and had systematically failed to answer, or answered late, requests for access, erasure and objection. In addition, TIM must secure its lead process, strengthen oversight of the sales chain and adapt its procedures for data subject rights.

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Marketing and consent

Legal basis

Art. 5, 6, 7, 12, 15–22, 24, 25, 28 und 32 DSGVO; Art. 130 Codice in materia di protezione dei dati personali (D.Lgs. 196/2003)

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Employees

10,000 or more

Culpability

negligent

Repeat case

yes

Mitigating circumstances

Taken into account as mitigating: short period and limited number of data subjects, measures taken during the proceedings (including checks on and termination of contracts with partners), a high level of cooperation, no special categories of personal data, adherence to the telemarketing code of conduct and substantial investment in controlling the sales chain.

Published

31 Jul 2026

Checked against the official source on 28 Sep 2026 · Direct link

The CNIL (French data protection authority) fined the IT and engineering consultancy EXTIA EUR 300,000 because, of 265 erasure requests received in 2024 – mostly from job applicants, occasionally from former employees – 12 were not processed at all and 166 applicants were not told of the outcome; 27 received their reply only after the one-month deadline. The CNIL regarded this as particularly negligent, especially as the company had already been reminded of its obligations by the CNIL twice in 2024 (Art. 12 and 17 GDPR).

Authority / court

Commission nationale de l'informatique et des libertés (CNIL), formation restreinte

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 12 und 17 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Employees

1,000 to 9,999

Culpability

negligent

Repeat case

yes

Mitigating circumstances

During the proceedings the company deleted the data concerned and informed the applicants retrospectively.

Published

9 Sep 2026

Checked against the official source on 2 Oct 2026 · Direct link

A synchronisation error between two applications allowed a customer to retrieve other customers’ invoices in the mobile app; in addition, the ticketing platform, which was publicly accessible without VPN, MFA or IP restriction, was attacked and a very large data set (including copies of identity documents, card data, IBANs) was exfiltrated. The Romanian data protection authority (ANSPDCP) imposed fines of 104,780 lei (20,000 EUR, Art. 25) and 419,120 lei (80,000 EUR, Art. 32), a total of 523,900 lei, and ordered test and change management. Date = publication of the press release; according to the authority, the investigation was concluded in the previous month.

Authority / court

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 25 Abs. 1, Art. 32 Abs. 1 lit. b und d, Abs. 2 und 4 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Published

17 Jul 2026

Original amount 523,900 RON, converted at the ECB reference rate of 17 Jul 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Germany's Federal Financial Supervisory Authority (Bundesanstalt für Finanzdienstleistungsaufsicht, BaFin) imposed a fine of 240,000 EUR on the software company because it had not disclosed the information about a cyberattack it had suffered as inside information without delay. The fine notice is final.

Authority / court

Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin)

Area of law

Capital markets and financial supervision · Disclosure and reporting obligations

Legal basis

Art. 17 Abs. 1 UAbs. 1 MAR (EU) Nr. 596/2014

Action

Fine

Status of proceedings

final

Sector

Telecoms, IT and software

Published

20 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

The Controladoria-Geral da União (CGU, Office of the Comptroller General) imposed on RSX Informática Ltda. a fine of BRL 8,794,574.67, extraordinary publication of the decision and a three-year ban on tendering for and contracting with the Federal Union, including removal from the supplier register SICAF. The case concerned fraud in a tender (pregão nº 5/2017) of the former Ministry of National Integration and in the resulting contracts; through the price registration agreement, other federal bodies, including the social security institute INSS with a software contract, contracted with the company without holding their own tender.

Authority / court

Controladoria-Geral da União (CGU)

Area of law

Bribery and corruption

Legal basis

Lei nº 12.846/2013, Art. 5 IV d, Art. 6 I und II; Lei nº 10.520/2002, Art. 7

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Published

10 Jul 2026

Original amount 8,794,574.67 BRL, converted at the ECB reference rate of 9 Jul 2026.

Checked against the official source on 3 Oct 2026 · Direct link

The Garante (Italian data protection authority) fined the US operator of the generative AI service Character.AI, on which users – including minors – chat with virtual characters, 158,000 EUR, among other things for deficient privacy information, a data protection impact assessment prepared late and the late appointment of a representative in the EU. It also criticised weaknesses in the protection of minors and in age verification; within 120 days the company must ensure working age verification, an effective cooling-off period preventing blocked minors from re-registering and private-by-default profiles for minors.

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 5 Abs. 2, 12 Abs. 1, 13 Abs. 1 und 2, 14 Abs. 1 und 2, 24 Abs. 1, 25 Abs. 2, 27 Abs. 1 und 35 Abs. 1 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Culpability

negligent

Repeat case

no

Mitigating circumstances

Mitigating: progressively strengthened age checks (a dedicated service for minors, age verification by a third-party provider), no previous relevant infringements, cooperation and amendments to the privacy policy during the proceedings.

Published

9 Jul 2026

Checked against the official source on 28 Sep 2026 · Direct link

After almost four years of litigation, the federal district court for Idaho entered an order agreed between the FTC and the data broker Kochava. The FTC had alleged that Kochava sold precise location data from hundreds of millions of mobile devices without the knowledge and consent of the people concerned, revealing, for example, visits to health facilities and places of worship. Kochava and its subsidiary Collective Data Solutions, which has taken over the data broker business, may only share sensitive location data with affirmative consent and for services requested by the consumer, and must introduce, among other things, a sensitive-locations programme, checks on their data suppliers, disclosure of recipients and retention limits; no payment is provided for. The authority allegedly made the findings set out here; this account is not based on a final judgment.

Authority / court

U.S. District Court for the District of Idaho auf Klage der Federal Trade Commission (FTC)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Section 5 FTC Act, 15 U.S.C. § 45 (unlautere Praktiken); Verfahren nach Section 13(b), 15 U.S.C. § 53(b)

Action

Order

Status of proceedings

final

Sector

Telecoms, IT and software

Published

26 Jun 2026

Checked against the official source on 3 Oct 2026 · Direct link

With the support of a consultancy, the three largest pay-TV providers agreed from 2019 to May 2025 to introduce advertising as a condition for accessing recordings and to standardise the marketing of this advertising space. The Autoridade da Concorrência (Portuguese Competition Authority, AdC) imposed 8,181,000 EUR on three companies; together with the fourth participant, already sanctioned earlier under a settlement, the fines add up to 13,351,000 EUR. Owing to ongoing court proceedings, the AdC did not publish the names in its announcement.

Authority / court

Autoridade da Concorrência (AdC)

Area of law

Competition law · Cartels and collusion

Legal basis

Lei da Concorrência (Lei n.º 19/2012), Art. 9.º (Processo PRC/2020/4)

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Published

5 Jun 2026

Checked against the official source on 25 Sep 2026 · Direct link

According to the complaint by the US Federal Trade Commission (FTC), Illuminate promised schools data security but did not adequately protect its cloud databases, even though a service provider had pointed out vulnerabilities almost two years earlier; a hacker accessed data on 10.1 million students, including health information. The order requires an information security programme, data minimisation and a public deletion schedule, and prohibits misrepresentations about security and notification deadlines.

Authority / court

Federal Trade Commission (FTC)

Area of law

Data protection · Data breaches and data security

Legal basis

FTC Act (Verbot unlauterer und irreführender Praktiken)

Action

Order

Status of proceedings

final

Sector

Telecoms, IT and software

Culpability

negligent

Published

5 Jun 2026

Checked against the official source on 25 Sep 2026 · Direct link

The provider of a travel booking system continued to provide services to Ural Airlines, designated in May 2022, requested payments of around 906,600 USD and, after the funds were frozen by the bank, looked for alternative payment routes, which HM Treasury's Office of Financial Sanctions Implementation (OFSI) regarded as circumvention. A lack of escalation during a change of roles, vacant leadership positions in legal and compliance, policies focused on US law and screening that did not flag the designation all contributed. According to the annual accounts filed with the UK companies register for financial year 2024, the company had around 150 employees.

Authority / court

HM Treasury, Office of Financial Sanctions Implementation (OFSI)

Area of law

Sanctions and export control · Breaches of sanctions and embargoes

Legal basis

Russia (Sanctions) (EU Exit) Regulations 2019, regs. 13, 14, 19

Action

Fine

Status of proceedings

final

Sector

Telecoms, IT and software

Employees

50 to 249

Mitigating circumstances

Voluntary disclosure (31 October 2022) and full cooperation; settlement under the new settlement procedure

Published

17 Jun 2026

Original amount 1,000,920.59 GBP, converted at the ECB reference rate of 26 May 2026.

Checked against the official source on 28 Sep 2026 · Version 3 · Direct link

Attackers posed as technical support, induced staff at points of sale to grant system access and obtained data on more than 365,000 customers, including payment data for 41,359 of them. The Italian data protection authority (Garante per la protezione dei dati personali) criticised deficient management of access credentials and digital certificates as well as inadequate security assessments, and imposed 1,715,600 EUR.

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO (Integrität und Vertraulichkeit, Art. 32)

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Published

16 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

In its own online shop for Galaxy S25 pre-orders, KT Corporation stated that benefits would apply unless the end of the promotion was shown, but then limited them to the first 1,000 orders and unilaterally cancelled 7,127 pre-orders that had come in via a YouTube channel and Genie TV and had already been fully completed. The authority regarded this as false information on key terms and an unjustified refusal to conclude contracts under the Telecommunications Business Act (전기통신사업법), imposed a fine of 640,000,000 KRW and ordered KT to show additional pre-order benefits clearly in future.

Authority / court

Korea Media and Communications Commission (KMCC, 방송미디어통신위원회)

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

Telecommunications Business Act (전기통신사업법) Art. 50(1) Nr. 5 und Nr. 5-2

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Published

8 May 2026

Original amount 640,000,000 KRW, converted at the ECB reference rate of 8 May 2026.

Checked against the official source on 4 Oct 2026 · Direct link

Four Australian companies of the Canva group did not lodge their financial reports for the 2024 financial year with ASIC by the due date of 30 April 2025; the consolidated report followed only on 27 March 2026. ASIC issued an infringement notice of allegedly AUD 198,000 to each company (AUD 792,000 in total); the notices were paid, which is not an admission of guilt.

Authority / court

Australian Securities and Investments Commission (ASIC)

Area of law

Capital markets and financial supervision · Disclosure and reporting obligations

Legal basis

s 319(1) Corporations Act 2001 (Cth); Bußgeldbescheide nach s 1317DAM

Action

Fine

Status of proceedings

final

Sector

Telecoms, IT and software

Published

6 May 2026

Original amount 792,000 AUD, converted at the ECB reference rate of 28 Apr 2026.

Checked against the official source on 3 Oct 2026 · Direct link

The Privacy Commissioner found that the rental application platform 2Apply collected more personal information than necessary from March 2020 to March 2025, such as gender, student status, citizenship, visa expiry and previous living arrangements, and did so unfairly through design techniques such as “confirmshaming”, biased framing and bundled consent. The determination requires IRE to stop this collection within 60 days, engage an independent reviewer and report to the OAIC within twelve months on implementing the recommendations.

Authority / court

Office of the Australian Information Commissioner (OAIC)

Area of law

Data protection · Data subject rights and transparency

Legal basis

APP 3.2 und APP 3.5 (Privacy Act 1988 (Cth)); Feststellungen nach s 52(1A)

Action

Order

Status of proceedings

unknown

Sector

Telecoms, IT and software

Mitigating circumstances

IRE adapted its collection practices during the investigation without admitting a breach.

Published

22 Apr 2026

Checked against the official source on 3 Oct 2026 · Direct link