Data of all Dutch police officers compromised in an alleged state-sponsored cyber attack
The Dutch National Police has revealed a cyberattack that has compromised the data of all police officers, and investigations to date suggest that a state-sponsored threat actor could be behind it.
On Sunday (October 6), police revealed that threat actors had extracted the work-related contact details of their entire police force, including names, email addresses and phone numbers.
“I have spoken to many colleagues in recent days who had questions and concerns. Concerns I share, because to provide security outside, one must feel safe inside,” Police Chief Janny Knol wrote.
According to Europol, the Netherlands has a total of 65,000 employees, including 51,000 police officers and 14,000 employees “carrying out other functions that support police work.”
Initially, according to a letter from the Minister of Justice and Security sent on September 26 to the Dutch House of Representatives, the incident did not pose a risk to personal data; However, the Dutch National Police has since said that, although not in all cases, some of those affected also had “private information” stolen.
The Dutch National Police added that the stolen data belongs only to current and recently retired officers; However, some external partners, such as those working in the judicial council or in the public ministry, could be at risk.
“If you resigned before July 24, 2024, your data was not involved in the hack,” it said.
“External people whose data may have been leaked have received an email. The organizations they are part of have also been informed.”
Based on investigations to date, police have said the hacker behind the breach is “most likely a state actor” but did not reveal who they suspected was the culprit.
“Based on information from intelligence services, the police immediately implemented strong security measures against this attack,” the Dutch National Police added.
“In order not to sensitize the perpetrators and not to prejudice future investigation, nothing more can be said at this time.”
Those affected have been advised to be on the lookout for additional access attempts, such as through phishing emails, phone calls, and other suspicious activity.
