The 17 biggest cyber attacks in the Netherlands of all time

The biggest cyber attacks in the Netherlands share one uncomfortable pattern: they rarely start with a genius hacker. They start with a password that was used twice, a VPN without multi-factor authentication, a phishing email that looked real, or a supplier who was never checked. This list covers seventeen documented Dutch cases, from the country’s largest telecom breach and a hospital software giant to the KNVB and a chain of dental practices, and what they cost.

The numbers behind the cases keep climbing. The Dutch Data Protection Authority received 39,407 data breach reports in 2025, up from 37,839 a year earlier, with 2,428 of them caused by a cyber attack and a sharp rise in breaches through phishing. In the Cybercrimebeeld Nederland 2026, published on 3 September 2026, the police and the Public Prosecution Service estimate that 2.5 million Dutch people fell victim to cybercrime or online fraud in 2025. If you want the basics first, read what a cyber attack is; below we go straight to the cases, newest first.

The biggest cyber attacks in the Netherlands

1. Odido (2026)

On 12 February 2026, telecom provider Odido confirmed the largest data breach in Dutch history. The hacker collective ShinyHunters had gained access to a file with the data of around 6.2 million customer accounts, of Odido and its brand Ben, and claimed to hold data on more than 8 million current and former customers in total, over 21 million records. Full names, addresses, phone numbers, dates of birth, email addresses, bank account numbers and the numbers and expiry dates of passports and driving licences were stolen. Passwords and call records were not.

The way in was pure social engineering: the criminals phished the passwords of individual customer service employees by email, then phoned them pretending to be the IT department to talk them past multi-factor authentication. Odido refused to pay the ransom, after which the group published the full dataset. A collective claim against the company followed within two months. One phone call to a helpdesk employee was enough to expose a third of the country.

2. ChipSoft (2026)

On 7 April 2026, ransomware hit ChipSoft, the company behind HiX, the electronic patient record used by roughly three quarters of Dutch hospitals. ChipSoft took Zorgportaal, HiX Mobile and its Zorgplatform offline as a precaution, and at least eleven hospitals, including Erasmus MC and Medisch Spectrum Twente, disconnected from the supplier. The healthcare security centre Z-CERT and the NCSC coordinated the response.

Two weeks later the group calling itself Embargo claimed to have stolen around 100 gigabytes of data and threatened to publish it. ChipSoft confirmed it had negotiated with the attackers and stated on 28 April that the stolen data had been destroyed. Whether a ransom was paid, and how much, has never been disclosed. For hospitals the lesson was blunt: a single supplier can take down the patient record of an entire country, which is why information security in healthcare is treated as a separate discipline.

3. Clinical Diagnostics and the cervical cancer screening (2025)

In August 2025, Bevolkingsonderzoek Nederland announced that criminals had stolen the data of more than 485,000 women who took part in the national cervical cancer screening programme. The breach happened at Clinical Diagnostics in Rijswijk, a laboratory owned by Eurofins that analyses the samples. Names, addresses, citizen service numbers, test results and the names of referring doctors were among the stolen files, some of them dating back to 2016.

The attackers demanded a ransom from Eurofins and threatened to publish the data. The Public Prosecution Service opened a criminal investigation, the Health and Youth Care Inspectorate started an inquiry into the lab’s security, and the screening programme suspended its cooperation with the laboratory. It is the largest medical data breach the Netherlands has seen, and it hit people who had done nothing more than accept an invitation for a routine test.

4. Openbaar Ministerie (2025)

On 17 July 2025 the Public Prosecution Service disconnected its entire IT environment from the internet after the NCSC warned about a vulnerability in Citrix NetScaler, the system that provides remote access. The technical investigation later confirmed that the vulnerability had actually been exploited. No manipulation or theft of data has been established, but the precaution alone was expensive.

For almost three weeks, prosecutors could not work remotely, case files were partly inaccessible and court cases were delayed. Email only returned on 7 August, and the organisation came back online step by step. The case shows what a single unpatched appliance at the edge of a network can do to an organisation that the whole criminal justice chain depends on.

5. TU Eindhoven (2025)

On Saturday evening 11 January 2025, the IT team of Eindhoven University of Technology noticed suspicious activity on its servers and pulled the plug on the network that same night. For the 14,000 students, education stopped for a full week, exams were postponed and systems stayed unavailable for about a week and a half. According to the university’s own evaluation, the attacker was preparing to deploy ransomware.

The cause turned out to be painfully ordinary: the attacker logged in through the VPN with passwords from accounts that were already known to have been leaked. The VPN had no multi-factor authentication yet, and nothing alerted anyone that old, compromised passwords were still in use. The university has since replaced its VPN and enforced MFA on it.

6. Nationale Politie (2024)

In September 2024 the Dutch police reported that attackers had gained access to an Outlook global address list and stolen the business contact details of around 62,000 police officers: names, email addresses, phone numbers and in some cases private data and photos. Email addresses of partner organisations were taken as well.

The intelligence services AIVD and MIVD, who alerted the police to the intrusion, consider it highly likely that a foreign state was behind it. It was not ransomware and no systems went down, yet the impact was serious: for officers who work undercover or on sensitive cases, a leaked name and phone number is a personal safety problem, not just a privacy one.

7. KNVB

In April 2023, the KNVB became the victim of a ransomware attack by the Russian-speaking LockBit group, which threatened to leak sensitive documents unless the football association paid. In September the KNVB confirmed it had paid. The exact amount was never made public, but the demand was reported to be around 1 million euros. The chairman of the Dutch Data Protection Authority reacted sharply, saying that paying keeps “a reprehensible business model” alive, because nothing guarantees the criminals will not sell the data anyway.

Lockbit threatened to share up to 300 GB of data, including passports and salary information from players of Oranje. The KNVB shared that they paid the ransom, but that the information may still be leaked.

8. Gemeente Hof van Twente

“Hello, need data back? Contact us fast.” That’s the message that Hof van Twente received in December 2020. The municipality turned out to be hacked, and their services to the community were paused for months on end because of it. The cyber criminals requested a ransom of 750.000 euros, but Hof van Twente refused to pay.

Because of this, all the software systems had to be rebuilt from the ground up. This cost the municipality 4.2 million euros in damages, which adds up to about 120 euros per resident.

The hackers were able to get into the one of the servers because the password turned out to be ‘Welkom2020’. Aside from that, more elementary precautions had not been taken by the municipality.

9. Universiteit Maastricht

Back in 2019, the University of Maastricht paid a ransom of 200.000 after being hit by a cyber attack. The ransomware shut down the university’s software systems for months. At that point, the university stated they saw no other way out than to simply pay the ransom.

After research done by Fox-IT, it became clear that the data leak was caused by a phishing attack. Somebody in the organization of the university had clicked a phishing link that looked like ‘the real deal’.

Once the cyber criminals were in, they also profited of multiple security updates not being done by the university. After a while, they had taken hostage of the entire network. The bad actors shut off the anti-virus software and shut down the systems.

The back-ups were also connected to the network so that the bad actors could also encrypt those.

This is one of the few stories about data leaks that actually has a somewhat positive ending. In 2022, the authorities found a part of the ransom that had been paid in crypto currency. Since the bitcoin had increased in value, they actually made a big profit when they got it back. The 200.000 euros they paid was now valued at 500.000.

10. VDL

VDL Groep, a big concern with 105 companies spread across Europe, America and Asia, was hit by a ransomware attack in 2021. All 105 companies were hit by the attack. This put a lot of their factories out of production and prevented them to communicate via email. It’s not clear how much ransom was asked by the cyber criminals.

In 2021, VDL Groep employed over 15.000 people worldwide and in 2020 they made 4,7 billion euros in revenue.

11. Van der Helm Logistics

Richard van der Helm, CEO of Van der Helm Logistics, always claimed to never pay criminals. That was until he found out that the computer systems of his logistics company had been hacked. The systems were completely shut down and the bad actors requested a ransom. Two days later, he paid the ransom.

After a security company told him that all the systems had to be revived and rebuilt, he knew it would take him weeks. This meant that contractual obligations wouldn’t be met and the company would go bankrupt in no time.

Van der Helm used an outdated VPN and didn’t use detection software. The bad actors had been trying countless variations of passwords. This activity would have been noticed with detection in place.

12. Gemeente Alkmaar

The municipality of Alkmaar also fell victim to a cyber criminal. Somebody who posed as the CEO of another organization sent an invoice of 236.000, which was paid under pressure of the fake CEO. This form of identity fraud is something we are seeing more often in the past couple of years.

Earlier, in 2020, Alkmaar had already been a victim of cyber crime when an employee clicked a phishing link. This lead to the data of thousands of residents to be public for a short period.

Both incidents are clear examples of why security awareness training is crucial.

13. De Mandemakers Groep

Back in 2021, the Mandemakers Groep was hit by a ransomware attack. The attack caused all computer systems to be shut down completely. The company didn’t want to share too many details about the attacker or the height of the ransom, but shared it was a “considerable amount”. In most cases, especially in 2021, attackers ask for huge amounts in bitcoin or other crypto currency.

14. RTL

Another striking example of a cyber attack was when RTL got hit by ransomware. The ransom of 8500 euros wasn’t high, which is interesting since RTL is such a well-known brand.

In this case, the attackers got access to RTL’s network because the login details of an employee from an external IT company were captured. This company was responsible for RTL’s network. There was no two-factor authentication in place, so the attackers could easily access the network.

The bad actors used the ransomware CryTOX to encrypt files on a couple of computers. On the screen a message was shown with the request to pay a ransom. A couple of important internal systems, such as the editorial system and the advertising planning system, were also shut down.

15. Mediamarkt

Back in 2021, Mediamarkt was hit by a ransomware attack. This paused their entire online business for weeks, forcing the company to only sell products that were available in-store. The attack hit a lot of Mediamarkt’s Windows systems, including 49 stores throughout the Netherlands.

The organization behind this attack is called Hive. This group is known to usually ask for millions of ransom in bitcoin. When Mediamarkt started a chat with the group, they replied as nicely as an average customer service agent would. “Hi, welcome to Hive. How can I help you today?” And after four hours of no reply, their second message is: “To make your files accessible again, you will need to pay 50 million dollars in bitcoin.”

Mediamarkt decides not to pay this ransom and the negotiations take a long time. In the end, they don’t pay at all.

16. Colloseum Dental Benelux

Colloseum Dental Benelux, an organization with 120 dental practices throughout the Netherlands, were forced to close for a short period when they were hit by a cyber attack. The organization treats over 600.000 patients per year.

All the practices were hit by a ransomware attack. Because of this, dentists couldn’t access the files of their patients, which made it impossible for them to do any treatments. The back-ups weren’t accessible.

The ransom that was asked has been paid by the dental company. “This was the only way for us to minimize the short term risk for everybody involved.” The exact amount of the ransom hasn’t been communicated.

17. ID-Ware

In 2022, the IT company ID-Ware got hacked. ID-Ware was responsible for the personal data of 3500 government officials, amongst other businesses. ID-Ware discovered that hackers had tried to infiltrate their systems. With ransomware, the bad actors encrypted sensitive data.

ID-Ware quickly recovered all data, but security specialists found that a large number of files had been made public.

According to De Volksrant, the organization ALPHV/BlackCat is responsible for the attack. They published a lot of information on the dark web.

The biggest cyber attacks in the Netherlands at a glance

Seventeen cases in one table. Read the last column: phishing, a reused password, a supplier or a missing second factor. The same door, every time.

What these attacks have in common

Put the seventeen cases next to each other and the technology is almost never the interesting part. Odido lost the data of millions because a helpdesk employee believed a caller from “IT”. Hof van Twente was opened with the password Welkom2020. TU Eindhoven fell to leaked passwords on a VPN without MFA. RTL was entered through the login of an external IT supplier, again without a second factor. Maastricht and Alkmaar started with one employee clicking a phishing link. ChipSoft and the screening lab show the other recurring theme: your data lives with suppliers, and their weakest employee is your problem too.

That matches the wider numbers. In Verizon’s 2025 Data Breach Investigations Report, roughly six in ten confirmed breaches involved a human action: a click, a phone call that was believed, a file sent to the wrong person. The NCSC’s overview of ransomware in 2025 counted 65 attacks reported to the police, and noted that a growing share of them began with a taken-over account rather than a technical exploit. Many people still assume these attacks only hit big names. They do not: the same groups run the same playbook against a logistics firm with a few dozen staff, and small companies have fewer people to notice something is wrong.

What a data breach means for your company

Every case above was also a data breach in the legal sense: personal data ended up with people who were not allowed to see it. Under the GDPR it does not matter how it happened. A ransomware attack counts, but so does an email with a customer list sent to the wrong address, a lost laptop or a supplier that leaves a database open. Three obligations follow, and they apply to a sole trader as much as to a hospital.

• Report it to the Dutch Data Protection Authority within 72 hours. The clock starts when you discover the breach, not when you understand it. Reporting goes through the AP’s breach notification portal. You only skip the report if the breach is unlikely to pose any risk to the people involved, and you have to be able to explain why.
• Inform the people affected when the risk is high. Leaked login details, medical data, identity documents, financial data or data about someone’s religion or origin count as high risk. Tell people what happened and what they can do, for example change a password or watch for fraud. Properly encrypted data that the attacker cannot read is the main exception.
• Keep a record and prepare for the fine. Every breach, reported or not, goes into your internal breach register. Failing to report can be fined up to 10 million euros or 2% of worldwide turnover; for the underlying security failure the ceiling is 20 million euros or 4%. In practice the damage is usually elsewhere: rebuilding systems, weeks of lost productivity, and customers who no longer trust you.

Why do criminals want this data at all? Because it converts. Stolen names, addresses and citizen service numbers are used for identity fraud: ordering products in someone else’s name, opening accounts, signing contracts. Leaked email addresses and phone numbers feed the next round of phishing and smishing, which is far more convincing when it uses a real order number or a real doctor’s name. And the data is the leverage in almost every modern ransomware case: pay, or we publish. The NCSC noted that in 2025 attackers routinely stole data before encrypting anything, and sometimes skipped the encryption altogether.

How do you prevent a cyber attack or data breach?

No organisation makes itself unhackable. But the cases above show that most attacks would have stopped at one of these six steps.

1. Multi-factor authentication on everything that faces the internet. Email, VPN, remote desktop, the admin panel of your website. TU Eindhoven and RTL were both entered through a login without a second factor.
2. Patch edge systems within days, not months. VPN appliances, firewalls and Citrix-style gateways are the first thing attackers scan for. The Public Prosecution Service went dark for three weeks over one of them.
3. Retire old accounts and reused passwords. Check your domains against known password leaks, force resets, and remove accounts of people who left. Use a password manager so that unique passwords are the easy option.
4. Backups that an attacker cannot reach. Maastricht’s backups were on the same network and were encrypted along with everything else. Keep at least one copy offline or immutable, and test the restore.
5. Know your suppliers. Ask your IT partner, your lab, your software vendor how they handle MFA, patching and incident response. Put breach notification in the contract. ChipSoft’s customers found out through the media.
6. Train the people, and keep training them. One awareness session a year does not change what someone does on a Friday afternoon under pressure. Short, regular training and realistic phishing simulations do. This is where Guardey comes in: weekly challenges of a few minutes that turn recognising phishing, CEO fraud and suspicious logins into a habit, with a dashboard that shows you where the risk sits. Read more about security awareness training.

And if it goes wrong anyway: isolate, call for help, report within 72 hours, and think twice before paying. The police, the Public Prosecution Service and the Data Protection Authority all give the same advice, and the KNVB case shows why: paying does not buy back control of the data, it only funds the next attack.

Frequently asked questions about cyber attacks in the Netherlands

What was the biggest cyber attack in the Netherlands?

Measured by the number of people affected, the Odido breach of February 2026 is by far the largest: data of around 6.2 million customer accounts, including identity document numbers and bank account numbers. The most sensitive breach is the 2025 theft of test results of more than 485,000 women from the cervical cancer screening. Measured by societal impact, the ChipSoft ransomware attack of April 2026 stands out, because it disrupted the patient record system of most Dutch hospitals at once.

How many data breaches are reported in the Netherlands each year?

The Dutch Data Protection Authority received 39,407 data breach reports in 2025, compared with 37,839 in 2024. About 2,428 of those were caused by a cyber attack, and the AP saw a sharp rise in breaches that started with phishing. Most reports still come from ordinary mistakes, such as data sent to the wrong recipient.

Do I have to report a data breach?

Yes, unless the breach is unlikely to pose any risk to the people involved. Report it to the Dutch Data Protection Authority within 72 hours of discovery, inform the people affected if the risk to them is high, and record every breach in your internal register, including the ones you did not report.

Should you pay the ransom after a ransomware attack?

The Dutch police, the Public Prosecution Service and the Data Protection Authority advise against it. Payment gives no guarantee that stolen data is deleted, and it finances the next attack. Organisations that had tested offline backups, such as Hof van Twente and Mediamarkt, were able to refuse, and Odido refused even though the data was then published. Those that did not, such as the KNVB and Colloseum Dental, felt they had no choice.

Are small companies also targeted by cyber attacks?

Yes, and increasingly so. Ransomware groups automate their search for vulnerable VPNs and leaked passwords, so company size hardly matters to them. Van der Helm Logistics and Colloseum Dental are on this list not because they were famous, but because they were reachable.

The seventeen organisations on this list had budgets, IT departments and, in most cases, a security policy on paper. What they did not have, on the day it mattered, was a colleague who paused before clicking, a login that asked for a second factor, or a backup that the attacker could not reach. Those are not enterprise problems. They are the exact things a company of twenty people can fix this month, and the reason this list does not need to get any longer.