Dutch Organizations Report Data Breaches and Extended Unauthorized Access

Dutch authorities reported a prolonged compromise at the Dutch prisons agency DJI, where attackers reportedly maintained access for at least five months. Exposed information included staff email addresses, phone numbers, and security certificates, and the Dutch NCSC indicated the intruders also accessed phones, tablets, and laptops, though the extent of data access on those endpoints was not confirmed; DJI did not confirm whether access had been fully removed.

Separately, Dutch telecom Odido disclosed a data breach followed by an extortion attempt, after which attackers publicly released about 1M records (including 317k unique email addresses) and threatened additional leaks. The published data reportedly included names, physical addresses, phone numbers, bank account numbers, and customer-service notes; Odido’s notice also warned that dates of birth and government ID numbers (passport/driver’s license) were impacted. A Canadian Tire breach entry describes a different incident in Canada (October 2025) involving ~42M records with PBKDF2-hashed passwords and some partial payment-card metadata, and is not part of the Netherlands-focused events above.