Meta's €1.2 Billion GDPR Fine Explained: DPC, EDPB and US Data Transfers
Meta's 2023 €1.2bn GDPR fine: what Ireland's DPC decided, why the EDPB stepped in, and what it means for EU-US data transfers.
Breaches and penalties in the EU, EEA and UK, including GDPR fines.
2 articles
Losses (bars) Complaints (line)
Ransomware and data-breach complaints from critical-infrastructure sectors, 2024 (number of complaints, not money)
Ransomware Data breach
Complaints to the FBI IC3 from organisations in 14 US critical-infrastructure sectors (2024 report, p.12). The 2025 report names the most-hit sectors but gives no counts. Source: FBI IC3 Internet Crime Report 2024.
Ransom received per group (USD millions)
Ransom payments received, as stated by officials. Figures cover different periods and aren't comparable totals.
Each bar is one official statement; bar length uses its leading number only. Quotes and sources are on the Threat groups page.
What victims told the FBI they lost to cybercrime each year, from the annual reports of its Internet Crime Complaint Center (IC3). It counts every kind of cybercrime, not only data breaches: investment and romance fraud, business email compromise, ransomware and more. Most complaints come from the US. Read it as a floor: many victims never report, and no organisation publishes a worldwide total for breaches alone. 2012 and 2014 are missing because those reports give the total only inside a chart.
Sources
Average cost per data breach by industry (USD millions)
2026 2025
IBM/Ponemon, Cost of a Data Breach Report 2026, Figure 4. Earlier reports show industry costs only as chart images, so only 2026 and 2025 are listed. Source: IBM Cost of a Data Breach Report 2026.
Victims per group (number of organisations, not money)
Victims stated by officials (as-of dates differ)
Each bar is one official statement; bar length uses its leading number only. Quotes and sources are on the Threat groups page.
The average cost of one breach across the organisations IBM/Ponemon studied that year. A single global average was first published with the 2014 study; earlier studies were country by country.
Sources
| Year | Europe |
|---|---|
| 2026 | USD 4.93M ▼ below global average |
| 2025 | USD 4.32M ▼ below global average |
| 2024 | USD 4.93M ▲ above global average |
| 2023 | USD 4.21M ▼ below global average |
| 2022 | USD 4.01M ▼ below global average |
| 2021 | USD 4.08M ▼ below global average |
| 2020 | USD 4.17M ▲ above global average |
| 2019 | USD 4.33M ▲ above global average |
| 2018 | USD 4.17M ▲ above global average |
| 2015 | USD 4.30M ▲ above global average |
| 2014 | USD 4.21M ▲ above global average |
| 2013 | USD 3.98M |
Average total cost of a data breach as published in IBM/Ponemon "Cost of a Data Breach" reports, by report year, in US dollars. Early studies published only in local currency are left out, not converted. Each region is the average of the markets that year’s study reports for it (Europe: United Kingdom, Germany, Benelux, France, Italy, Scandinavia); hover a figure to see which. Years with no published figure are left out (the series starts in 2013); "Not in report" means that year’s study did not cover the region, not that it had no breaches. Averages are not added up across years: selecting several years on the map shows their average. Map colours run from yellow (lower cost) to dark red (higher cost), relative to the regions shown. ▲ / ▼: above or below that year’s global average cost per breach.
Meta's 2023 €1.2bn GDPR fine: what Ireland's DPC decided, why the EDPB stepped in, and what it means for EU-US data transfers.
How attackers skimmed British Airways card data in 2018, why the ICO fined £20m not £183.39m, and the controls the ICO says were missing.