Sweden's data protection authority IMY received 12,276 personal data breach reports in 2025, up from 6,514 in 2024, according to its Årsredovisning 2025. Controllers must report a breach that is likely to put people's rights and freedoms at risk within 72 hours. IMY says the surge came mainly from a few large incidents at data processors with many customers.
How many data breach reports does IMY receive?
In 2025 IMY received 12,276 reports and closed 12,191. The year before it received 6,514 and closed 6,064, and in 2023 it received 5,961 and closed 6,033. IMY's text says breach reports rose 89%, and the table counts work out to 88%, which is the same story at different rounding.
| Year | Reports received | Reports closed | Average handling time |
|---|---|---|---|
| 2023 | 5,961 | 6,033 | 63 days |
| 2024 | 6,514 | 6,064 | 42 days |
| 2025 | 12,276 | 12,191 | 94 days |
Source: IMY, Årsredovisning 2025, table 7 (the report is in Swedish; labels translated here).
Between 2023 and 2024 the count grew 9%. Between 2024 and 2025 it grew by 5,762 reports. IMY adds that incoming complaints from individuals rose 102% and that all cases rose 56%, from about 18,100 to about 28,300.
Figure 1: Personal data breach reports received by IMY, 2023 to 2025. Source: IMY, Årsredovisning 2025, table 7.
Breach reports almost doubled in one year after growing 9% the year before.
Why did reports jump in 2025?
IMY attributes the high count mainly to a number of larger incidents at data processors with many customers, and those customers are the controllers that must each file a report. The affected people totaled more than 1.5 million, and in some cases included children and people with protected identities. Several of the large incidents were ransomware attacks in which the attackers got into the IT environment, copied the data and published it.
That mechanism explains the shape of the number. One processor incident can trigger a separate report from each controller customer, so the count reflects how many organizations had to report, not how many separate attacks happened. For the wider pattern, see our figures on third-party data breaches.
If you rely on a vendor to host or process customer data, a breach at that vendor is still a report you owe.
How long does IMY take to handle a report?
The average handling time for a breach report rose from 42 days in 2024 to 94 days in 2025, and IMY says both the handling time and the share of cases older than 30 days increased for breach reports. About 3,700 cases were open at the end of 2025, of which about 1,500 were complaints and about 1,000 were breach reports. IMY says it cannot influence the inflow, and that it began working more proactively on big incidents, with guidance, information and dialogue meetings.
Figure 2: How a breach report moves through IMY, as described in its 2025 annual report. A summary of regulator text, not legal advice.
The deadline for you is 72 hours, but the regulator's own queue grew far longer than that.
How many fines does IMY issue?
Only three in 2025: SEK 75,000 each against Storstockholms Lokaltrafik (SL) and Waxholms Ångfartygs AB for storing data from an employee's alcohol tests without a legal basis, and SEK 100,000 against the Equality Ombudsman for inadequate security around a web form. That totals SEK 250,000. IMY issued 6 fines in 2024 and 11 in 2023, while its other corrective measures grew.
Figure 3: IMY's corrective measures under the GDPR, 2023 to 2025. Source: IMY, Årsredovisning 2025, table 5.
Reprimands rose from 19 to 109 and orders from 13 to 56 between 2023 and 2025, while fines fell from 11 to 3. Total GDPR corrective measures went from 43 to 94 to 168. IMY opened 326 supervisory cases in 2025, against 415 in 2024, and closed 493, against 322.
The fines tell a different story after the report year. IMY fined Sportadmin SEK 6 million on 28 January 2026 after a January 2025 attack that exposed data on more than 2.1 million people, mainly children and young people. On 1 October 2026 it fined Miljödata SEK 1.8 million after an August 2025 attack the company said affected 2.2 million individuals. In both cases IMY found the company's security inadequate for the data it processed.
Figure 4: IMY administrative fines in the three 2025 cases and the two 2026 breach decisions, in kronor. Source: IMY, Årsredovisning 2025, and IMY news releases of 28 January 2026 and 1 October 2026.
Reprimands and orders replaced fines in most cases, but the two largest decisions followed large cyberattacks.
Figure 5: Timeline of the two attacks and the fines that followed. Source: IMY news releases of 28 January 2026 and 1 October 2026.
The Bottom Line
IMY received 12,276 breach reports in 2025, nearly double 2024, mostly because a few large incidents at processors forced many customers to report at once. Handling times more than doubled to 94 days, and fines in the report year were just three, SEK 250,000 in total, though the two big breach fines of 2026 reached SEK 6 million and SEK 1.8 million. If you run a business with customers or users in Sweden, check which vendors process your data, who in your team decides within 72 hours whether a breach needs reporting, and what your contracts require of those vendors. A clear privacy policy that names the types of processors you use helps you meet the transparency side of the GDPR, but it does not replace security or a reporting process. For the penalties other regulators set for breaches, see GDPR fines for data breaches. This article is general information, not legal advice.
Frequently Asked Questions
How many data breach reports did Sweden's IMY receive in 2025? IMY received 12,276 personal data breach reports in 2025, according to its annual report. That compares with 6,514 in 2024 and 5,961 in 2023, so the 2025 count was almost double the year before.
Why did Swedish breach reports jump in 2025? IMY says the high number came mainly from a few larger incidents at data processors with many customers, who are the controllers that must report. More than 1.5 million people were affected in total, and several incidents were ransomware attacks.
How many GDPR fines did IMY issue in 2025? Three administrative fines: SEK 75,000 each against SL and Waxholms Ångfartygs AB, and SEK 100,000 against the Equality Ombudsman, SEK 250,000 in total. In 2024 it issued 6 and in 2023 it issued 11.
How long does a business have to report a breach to IMY? 72 hours. IMY's annual report says incidents likely to risk people's rights and freedoms must be reported within 72 hours. Its average handling time per report rose from 42 days in 2024 to 94 days in 2025.
Where the Numbers Come From
- IMY (Integritetsskyddsmyndigheten): Årsredovisning 2025. 12,276, 6,514 and 5,961 reports, closed counts, handling times, 89% and 56% increases, complaints up 102%, the processor and ransomware explanation, corrective measures, the three 2025 fines. Published in Swedish; translations here are ours.
- IMY: Administrative fine against Sportadmin (28 January 2026). SEK 6 million, January 2025 attack, more than 2.1 million individuals.
- IMY: Administrative Fine against Miljödata (1 October 2026). SEK 1.8 million, August 2025 attack, 2.2 million individuals according to the company.
Note: All figures verified as of November 2026 against IMY's annual report and news releases. The two 2026 fines postdate the report year, and IMY publishes a new annual report each year, so check for 2026 figures when they appear.
