Warning to one million women in the Netherlands due to a data breach of cancer screening information
Messages will be sent to nearly one million women in the Netherlands to warn them of the potential exposure of their personal data in a cyber attack. This breach targeted a laboratory in Rijswijk that handles information related to the national cervical cancer screening program.
The organization Bevolkingsonderzoek Nederland, responsible for population screenings in the Netherlands, confirmed that hackers were able to access sensitive data such as names, addresses, dates of birth, test results, gender indicators, and civil service numbers. The attack occurred in early July, and initial reports indicated that at least 715,000 women were affected, but authorities have now clarified that the total number may be larger.
The breached systems contain records of more than 941,000 individuals who participated in screening programs since 2017. As a precautionary measure, messages will be sent to all participants between September 12 and 17, regardless of whether their data has already been stolen or not.
It has also been revealed that the affected laboratory, Clinical Diagnostic, collaborated with private clinics and conducted research for the Dutch detention institutions agency. As a result, data of more than 250 current and former prisoners has been leaked. It is still unclear how many other institutions or individuals were affected by this attack.
Investigations indicate that the hacker group Nova is behind the operation. They demanded a ransom of 11 bitcoins – equivalent to about 1.1 million euros at the time – in exchange for stopping the publication of the stolen data. Clinical Diagnostic has already paid a significant amount, leading to the removal of part of the information from the dark web.
In response, the Bevolkingsonderzoek Nederland organization suspended its cooperation with the laboratory. It also began, in collaboration with RIVM and the National Cyber Security Center (NCSC), an investigation to determine how the breach occurred and the measures needed to prevent such incidents from happening again in the future.