9,000 Euro fine against Foundation for the Development of Nursing (FUDEN)
Ransomware attack exposes inadequate security measures at nursing organisations.

Following the report of a security incident, the Spanish Data Protection Agency (AEPD) initiated fine proceedings against FUDEN and SATSE. On January 28, 2024, the jointly responsible organizations fell victim to a ransomware attack that compromised the personal data of approximately 50,000 individuals, including names, contact information, and copies of identification documents. The investigation revealed inadequate technical and organizational measures: VPN access was secured without two-factor authentication, and the stored data was unencrypted. The AEPD initially imposed a fine of 15,000 EUR. Since FUDEN and SATSE acknowledged the violation and paid the fine voluntarily and on time, the authority reduced the amount by 40% to 9,000 EUR in accordance with Art. 85 of the LPACAP.