The agency registered 5,037 complaints of personal data violations in 2021, compared to 2,821 reported in 2020, and about 60 percent of them were computer attacks, whose main victims were small and medium-sized companies.

“With fewer resources than large companies to deal with these threats, they are the main targets of malicious actors,” the report noted, with three out of five cases involving premeditated acts.

Among the most affected were the science and health sectors, with increases of 191 and 195 percent, respectively, compared to 2020, since according to the CNIL, as an example, a hospital prefers to invest its budget in medical devices than in cybersecurity.

Among the most widespread attacks is “ransomware”, malicious programs that prevent the victim from accessing their data and demand a ransom, or even blackmail for the disclosure of personal data.

The fines also reached a record figure of 214 million euros, with the Ministry of the Interior among the sanctioned, which was fined in January for the use of drones without a legal framework regulating their use, and in September, for keeping the automated file of people’s fingerprints free of charge for too long.

pgh/llp/mem/acm