Barnaclínic fined 109,750 euros for data security failures

A Spanish court has confirmed a fine of 109,750 euros against Barnaclínic, a private medical center linked to Barcelona’s Hospital Clínic, following a major ransomware attack in March 2023.

The ruling by the Ninth Administrative Court of Barcelona upholds a sanction previously imposed by the Catalan Data Protection Authority (APDCAT). The court determined that Barnaclínic failed to implement sufficient security measures to protect sensitive information, leading to the compromise of approximately 4 terabytes of medical and personal data belonging to thousands of patients and employees.

The court identified three key violations of the EU General Data Protection Regulation (GDPR): the use of weak passwords without multi-factor authentication, insufficient risk assessments, and a failure to properly monitor external security audits. While Barnaclínic relied on the IT systems of Hospital Clínic, the judge ruled that the entity remained directly responsible for the data under its custody, describing the security breaches as “grave and evident.”