Norway DPA fines municipality NOK 4M

Norway's data protection authority, Datatilsynet, announced a fine of NOK 4 million against municipality Ostre Toten due to security deficiencies that led to a ransom attack on its IT systems and data in January. The ransomware attack compromised all personal information of Ostre Toten residents and employees, some of which was later published online. Datatilsynet will also require Ostre Toten to develop a secure management system and carry out risk assessments.