Loading story…
The Netherlands’ Tax and Customs Administration canceled its planned Microsoft 365 public-cloud rollout after an ICT advisory review identified shortcomings in information security, confidentiality, data control, and long-term sustainability. Concerns included routing confidential documents through U.S. servers, reliance on Microsoft’s standard encryption rather than double-key encryption, limitations in the proposed Teams encryption configuration, vendor lock-in, and an inadequate exit strategy. The findings apply to the selected deployment design, not to every Microsoft 365 configuration.
The administration will retain existing Microsoft software initially while planning on-premises email and calendar services in 2027 and European open-source storage and collaboration solutions during 2027–2028. No specific open-source replacement stack has been selected, and a complete replacement of Microsoft Office is not confirmed. The decision underscores the importance of validating encryption control, data sovereignty, and workable exit arrangements before committing sensitive public-sector workloads to cloud services.
Map this exposure pattern across your cloud, code, and identities.
6 events from the most recent confirmed update back to the earliest known activity.
In his July 9 letter, State Secretary E. Eerenberg provided Parliament with Auditdienst Rijk findings on backup arrangements intended to support an unexpected exit from the cloud-based office environment. The government said the findings would inform its assessment of an on-premises alternative.
Other Dutch government agencies began developing Digitaal Autonome Werkomgeving Overheid (DAWO), an autonomous digital working environment starting with replacement of Windows desktops by NixOS. France's La Suite and Germany's openDesk are being considered as office-suite options within this separate initiative.
The Dutch Tax and Customs Administration canceled its planned Microsoft 365 public-cloud deployment, with State Secretary for Finance Eelco Eerenberg outlining the replacement timetable in a letter to Parliament. The plan retains existing Microsoft software, introduces on-premises email and calendars in 2027, and targets European open-source storage and collaboration tools during 2027–2028, without selecting a specific replacement stack.
The Dutch government paused the deployment in July following the advisory council's recommendation. The suspension preceded the decision to abandon the planned public-cloud rollout.
In June, the advisory council recommended reversing the rollout after identifying weaknesses in the selected design's security, confidentiality, data control, and long-term sustainability. Its findings included concerns about U.S. servers, encryption arrangements, vendor lock-in, and an inadequate exit strategy; they did not apply to every Microsoft 365 configuration.
Approximately 5,000 employees had migrated to Microsoft 365 before the Dutch Advisory Council on ICT Assessment recommended reversing the public-cloud rollout. The administration had planned to complete the rollout by the end of 2026.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
4 references tracked. Mallory keeps watching after this page renders.
zdnet.fr
Open sourcezdnet.com
Open sourcetweedekamer.nl
Open sourceadviescollegeicttoetsing.nl
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Dutch police suffered a major data theft attributed to a **Russian cyber group** after attackers gained access via an employee’s **email account** and exfiltrated sensitive personnel information. Stolen data reportedly included the contact details of nearly all **~65,000 police officers**, along with profile photos and other personal data, triggering significant internal unrest and concern about officer safety and privacy. Investigative reporting indicates the organization had been **warned in advance** about security weaknesses relevant to the intrusion path. Documents obtained under the Netherlands’ Open Government/Woo framework describe an internal **November 2022 risk analysis** that raised concerns about the implementation and security of Microsoft’s **M365 cloud** (used for tools such as *Teams*), explicitly noting “inherent” cloud risks and that **state actors** would be highly motivated to access the environment. Following the 2024 theft, police reportedly stood up a heavy crisis response structure (the *Nationale Staf Grootschalig en Bijzonder Optreden*) to reduce immediate risk and implement additional security measures, while political and union voices characterized the incident as severe and questioned why earlier warnings were not acted upon.
Jun 29, 2026
Swiss public-sector data protection officers have issued a resolution urging government agencies to avoid using international software-as-a-service (SaaS) platforms, such as Microsoft 365, for sensitive data unless true end-to-end encryption is implemented. The resolution highlights that most SaaS solutions do not provide end-to-end encryption, leaving data accessible to providers and subject to foreign legal processes like the US CLOUD Act. This lack of control is seen as a significant risk to data sovereignty, as agencies cannot guarantee the confidentiality of particularly sensitive or legally protected information when using these services. The Swiss stance reflects a broader European skepticism toward foreign-owned hyperscale cloud providers, with similar concerns raised in Germany, France, Denmark, and by the European Commission. Security analysts emphasize that true data sovereignty requires government control over encryption keys, not just data residency. The resolution also warns that SaaS providers can unilaterally change terms and conditions, further eroding security and privacy guarantees for public sector data.
Jun 29, 2026The U.S. Department of Homeland Security released a Cyber Safety Review Board report concluding that the Summer 2023 intrusion into Microsoft Exchange Online by **Storm-0558**, a threat group linked to the People’s Republic of China, was preventable and resulted from a cascade of Microsoft security failures. The breach affected **22 organizations** and **503 individuals** worldwide, including senior U.S. officials, and led to the theft of about **60,000 State Department emails**. The board said Microsoft still does not know how the attackers obtained a critical signing key, rejected the company’s earlier crash-dump explanation as unproven, and faulted Microsoft for weak logging, delayed remediation, and failing to detect the intrusion itself. The review said Microsoft’s operational and strategic decisions reflected a corporate culture that deprioritized enterprise security investment and rigorous risk management, and it called for direct CEO and board oversight of security, accountability for senior officers, and stronger protections across Microsoft’s cloud products. The report also issued broader recommendations for cloud providers and government, including stronger identity and authentication controls, default audit logging, improved disclosure and victim notification, and updates to federal cloud security frameworks; DHS said CISA will convene major cloud service providers to align on those practices.
Jun 29, 2026