The Dutch National Police (Politie) says a security breach resulting from a successful phishing attack has had a limited impact and hasn’t affected citizens’ data.
It also stated that the incident is still under investigation by the agency’s security experts and that the attackers’ access to compromised systems has been blocked.
“The police have been the target of a phishing attack. The police’s Security Operations Center detected the incident very quickly and immediately blocked access,” the police said in a Wednesday press release.
“The impact is still being investigated but appears to be limited. Citizens’ data and investigative information were not exposed or accessed. The police have also launched a criminal investigation.”
The law enforcement agency has yet to disclose when the attack was detected and if any employees’ data was exposed during the breach.
A Police spokesperson didn’t immediately reply when BleepingComputer reached out for more information about the incident, including which systems or accounts were affected and whether any police officers had their data stolen, if any.
The Dutch police corps also disclosed a data breach in September 2024 following a cyberattack linked to a “state actor” that stole work-related contact information for multiple police officers, including their names, email addresses, phone numbers, and, in some cases, private data.
A follow-up investigation looking into the “nature, scope, and consequences of the data leak” is still ongoing, and the police have not publicly attributed the attack to a specific threat group or explained how it was carried out.
Following the attack, the police said they implemented stronger security measures to prevent future incidents, including continuously monitoring all systems for signs of suspicious activity and requiring officers to use two-factor authentication to log in to their accounts more frequently.
In February, Dutch authorities also arrested a 40-year-old man for an extortion attempt using confidential documents mistakenly shared by the Dutch police.
Automated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the other.
This whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic questions for any tool evaluation.
