Swedish insurance company Trygg-Hansa has received a GDPR fine of almost three million euros (35 million kroner).
After it became known that the insurer Trygg-Hansa had been very careless with the data of its customers for years, the company was fined by the Swedish data protection authority for this violation of the GDPR. The IMY asked Trygg-Hansa for payment of 35 million Swedish kroner, about three million euros.
child’s play
The ball started rolling after a customer of subsidiary Moderna Försäkringar discovered that it was possible to access Trygg-Hansa’s backend via links in offers sent to customers via SMS or email.
Each link contained a unique URL that led to the insurance company’s landing page. The backend was accessible without authentication; All you had to do was change the customer number it contained. Turns out those numbers were just sequential and not exactly a sophisticated hack. In addition, there was no need to look at private documents of the account behind each number.
Possible Consequences
In this way, the data of around 650,000 customers was almost unprotected between October 2018 and February 2021. Therefore, the IMY took a heavy toll during this long period.
The list of potential dates currently available for selection has been expanded:
- Personal Data
- health information
- Details of the terms of the contract
- finance
- contact details
- The Swedish version of the national registration numbers
- Insurance policy details
So far, the IMY has already confirmed 202 cases of unauthorized access to certain data, but this number could only be the beginning. The potential damage was possibly much greater, as such data is extremely attractive to cybercrime of all kinds. Hence the large fine for Trygg-Hansa. Anyone who knows a little Swedish or wants to practice beforehand can read the IMY’s full decision online.
In July of this year, the Swedish data protection authority Tele2 already heavily criticized for GDPR violations at Google Analytics. However, the fines back then were not as high as they are today. Meanwhile, the Belgian data protection authority was in the headlines earlier this week for dismissing almost four hundred complaints.