Issue #18 | November 2026, Week 2

Defense and aerospace contractors to pay $13M over cybersecurity violations

Jurisdiction

United States

Infringer Legal Name

ILC Dover, ILC Astrospace

Infringer Domicile

United States

Alleged Violation

Failure to meet cybersecurity requirements

Enforcement Action

$13 million fine

Case Status

Civil settlement

American defense and aerospace companies ILC Dover and ILC Astrospace have agreed to pay $13 million to settle allegations that they failed to meet cybersecurity requirements in contracts with the US Army, Missile Defense Agency and NASA.

The companies were accused of submitting false claims for payment while failing to properly protect sensitive government information. The alleged violations included using a third-party cloud service that did not meet required security standards and failing to maintain proper system security plans.

The companies also allegedly failed to fully implement required cybersecurity controls, address system weaknesses and submit up-to-date security assessments to the US Department of Defense.

DFSA fines Moody’s Middle East $585,825 over data breaches

Jurisdiction

Dubai

Infringer Legal Name

MISMEL

Infringer Domicile

Dubai

Alleged Violation

Failure to protect confidential data

Enforcement Action

$585,825 fine

Case Status

Regulatory settlement

The Dubai Financial Services Authority (DFSA) has fined Moody’s Investors Service Middle East (MISMEL) $585,825 (AED2.15 million) over several data breaches involving confidential information.

The regulator found that the company failed to maintain proper systems and controls to protect sensitive data and prevent employees from disclosing confidential information.

Between December 2023 and May 2026, MISMEL reported seven cases of accidental data disclosure to the DFSA. Four of the incidents involved confidential information being shared with external parties.

The DFSA said the breaches were linked to weak data security measures. The company has also removed a security tool and didn’t immediately replace it and implemented ineffective internal disciplinary procedures.

Because MISMEL agreed to settle the case early, the fine was reduced by almost 30%. Without the discount, the penalty would have been $836,892.

Courts fined S$178,000 after ransomware attack exposes data of nearly one million people

Jurisdiction

Singapore

Infringer Legal Name

Courts

Infringer Domicile

Singapore

Alleged Violation

Data protection violations

Enforcement Action

S$178,000 fine

Case Status

Administrative action

Electronics and furniture retailer Courts (Singapore) Pte. Ltd has been fined S$178,000 (€124,500) after a ransomware attack exposed the personal data of nearly one million people in September 2022.

According to Singapore’s Personal Data Protection Commission (PDPC), the attack affected 946,972 people, including 941,513 customers and 5,459 current, former and potential employees. The exposed information included customers’ names, identification numbers, addresses, phone numbers and some credit card details. Employee information, including bank account details and creditworthiness records, was also affected.

Investigations found that the attacker gained access to Courts’ network via two disaster recovery servers that were accessible over the internet. The attacker obtained an administrator’s login details and used the connection between the servers to access other systems.

Ransomware was then installed on 26 servers, with data on 20 servers being fully or partly encrypted. Courts detected the attack around September 26, following which hackers demanded a ransom to provide a password to recover encrypted files.

The retailer notified affected employees after discovering that their financial information had been accessed without authorization. However, the company did not notify customers, as it assessed the risk of significant harm to them to be low. Courts did not respond to the ransom demand or engage with the attacker further.

The company contained the incident by isolating affected servers, restoring systems from clean backups, installing security updates and tightening access controls. The PDPC found that Courts had breached its data protection obligations by failing to conduct regular security scans and apply timely security updates. Recovery servers had been excluded from vulnerability scans despite providing access to systems containing large volumes of personal data. Several servers also ran outdated operating systems, including Windows Server 2008, which had reached end of support in January 2020.

Polish college fined €15,000 over data breach affecting hundreds of students

Jurisdiction

Poland

Infringer Legal Name

Wyższa Szkoła Logistyki

Infringer Domicile

Poland

Alleged Violation

Data protection violations

Enforcement Action

A PLN 64,652 fine

Case Status

Administrative action

A Polish college has been fined PLN 64,652 (approximately €15,000) after accidentally exposing the personal data of 964 students. The breach occurred at Wyższa Szkoła Logistyki in Poznań, where an employee mistakenly attached a file containing students’ personal information to a notice about specialization and language group allocations.

The file was made available to 388 people, 125 of whom opened it. The file was downloaded 361 times, although it’s unclear how many individual users downloaded it.

Poland’s Personal Data Protection Office (UODO) found that the college had failed to properly assess the risks to students’ data. Its security procedures did not account for the possibility of employees accidentally sharing the wrong documents.

The college also failed to update its risk assessment after the incident. The institution claimed it had carried out checks on other notices sent to students but provided no documentation to support the claim.

UODO found that the college had breached several GDPR requirements relating to accountability and data security (Article 24 paragraph 1, Article 25 paragraph 1, and Article 32 paragraphs 1 and 2 of Regulation 2016/679). In addition to the fine, the regulator ordered the institution to reassess its risks and introduce appropriate technical and organizational safeguards to prevent similar incidents.

France fines local authorities over cybersecurity failures

Jurisdiction

France

Infringer Legal Name

Multiple entities

Infringer Domicile

France

Alleged Violation

Cybersecurity protection failures

Enforcement Action

Fines ranging from €3,000 to €20,000

Case Status

Administrative action

France’s national data protection authority (the CNIL) has issued ten financial penalties against local authorities and a public institution for cybersecurity failures that put citizens’ personal data at risk.

The investigations found several weaknesses in the security systems used by municipalities and other public bodies, including weak passwords, outdated server systems, a lack of multi-factor authentication for administrators and insufficient monitoring of suspicious activity. In some cases, external service providers also had permanent access to local authority networks or used shared accounts.

The CNIL also found that some authorities had failed to carry out required data protection impact assessments before introducing high-risk systems such as online platforms used by parents to manage their children's school activities and video surveillance systems installed in public areas.

According to the regulator, the failures increased the risk of personal data breaches, including the exposure of sensitive information such as children's data and bank details. Some of the authorities had already experienced data breaches that could potentially have been prevented with stronger security measures.

The fines range from €3,000 to €20,000, depending on the seriousness of the violations, the type of data involved, the number of people affected and the size of each authority's budget.