French Regulator Fines Nexpublica €1.7 Million for Major Data Security Failures In November 2022, users of Nexpublica’s portal discovered they could access sensitive third-party documents, prompting an investigation by France’s data protection authority, CNIL. The regulator determined that the software company’s security measures were severely inadequate, failing to meet basic cybersecurity standards. On December 22, CNIL imposed a €1.7 million ($2 million) fine on Nexpublica France, citing the company’s financial capacity, its lack of fundamental security knowledge, the number of affected individuals, and the sensitivity of the exposed data. The breach underscored systemic vulnerabilities in Nexpublica’s data protection practices, raising concerns over the handling of confidential information. The incident highlights the growing scrutiny of cybersecurity lapses by European regulators, particularly under GDPR, where non-compliance can result in significant financial penalties. Nexpublica’s case serves as a notable example of enforcement actions targeting companies that fail to implement essential safeguards.