Finnish Privacy Ombudsman Fines Bank $2.1M for Security Breach
Finland's Data Protection Ombudsman fined S-Bank 1.8 million euros ($2.1 million) for lax data security that led to a 2022 security breach, it announced Wednesday.
Sign up for a free preview to unlock the rest of this article
Privacy Daily provides accurate coverage of newsworthy developments in data protection legislation, regulation, litigation, and enforcement for privacy professionals responsible for ensuring effective organizational data privacy compliance.
The regulator investigated a security breach based on an S-Bank notification in August 2022, it said, according to an unofficial translation. In April, a new login functionality in the bank's mobile app showed a security vulnerability that was available from April to August.
The probe found that the bank lacked adequate safeguards to ensure the security of personal data. It hadn't tested its new software before deployment and hadn't detected the vulnerability until the system began functioning, the ombudsman said. The bank also failed to respond adequately to contacts with customers who reported deviations when logging into their online banking.
S-Bank's operations violated General Data Protection Regulation requirements for the secure processing of personal data, the regulator said. The steep fine was based on the need for legal protection of individuals, the general significance of the case and an earlier criticism made to S-Bank by the European Data Protection Supervisor, it added.
"You have to act quickly in situations like this," said Deputy Data Protection Officer Annina Hautala. "Customers must be able to trust that their bank and account information is safe."
Finland's Financial Supervisory Authority in May 2025 imposed a 7.67 million euro fine over S-Bank's management of operational risks, the ombudsman noted. Because that penalty had already been assessed, the ombudsman's fine was about one-third of what it would have been otherwise, it added.
The bank can appeal the decision to an administrative court.