French software company fined $2 million for cyber failings leading to data breach

France’s data protection regulator (CNIL) fined Nexpublica France €1.7 million after a November 2022 breach where users of a company portal could access third-party documents, concluding the firm’s security program was inadequate; the December 22 decision cited financial capacity, lack of basic security principles, number of people affected, and data sensitivity. See the CNIL [press release](https://www.cnil.fr/en/data-security-nexpublica-france-fined-eur1700000) and coverage by [The Record](https://therecord.media/french-software-fined-cnil).