2026 BCM RELATED INCIDENTS IN THE NETHERLANDS
  • Home
  • 1 st Quarter
    • January, click for totals or click submenu >
      • Headlines - January
      • Saftety warnings and recalls - January
      • Incidents - January
    • February, click for totals or click submenu >
      • Headlines - February
      • Saftety warnings and recalls - February
      • Incidents - February
    • March, click for totals or click submenu >
      • Headlines - March
      • Saftety warnings and recalls - March
      • Incidents - March
  • 2nd Quarter
    • April, click for totals or click submenu >
      • Headlines - April
      • Saftety warnings and recalls - April
      • Incidents - April

Headlines March

Picture
Picture
Picture
AkzoNobel Data Breach: Financial Data and Passports Leaked
Paint giant AkzoNobel has been hit by a major cyberattack. The notorious ransomware group Anubis has claimed responsibility for the hack and has since published a large amount of stolen data on the dark web.The news was reported via LinkedIn by cybersecurity expert Erik Westhovens. According to Westhovens, the leaked data contains highly sensitive personal and confidential business information.

Passports and NDAs out in the open
The haul that Anubis has posted on their “leak website” is extensive. It includes, among other things: Identity documents: Copies of passports belonging to employees or other individuals involved. Legal documents: Non-disclosure agreements (NDAs) with both customers and suppliers. Financial data: A large volume of internal financial reports and statements.

“You get what you pay for”
Westhovens, founder of the AI security platform Ransomwared, has long warned about the consequences of inadequate digital security. “If you think good security is expensive, just try bad security,” says the entrepreneur. The damage to AkzoNobel from this breach may not only be financial but could also lead to significant reputational damage and legal claims from partners whose data is now out in the open. It is currently unclear how the attackers gained access and whether a ransom has been demanded. AkzoNobel has not yet officially responded to the scale of the publication on the dark web.

Source: https://www.dutchitchannel.nl/news/726176/

Lelystad Youth Services Office Closed—Staff Have Called In Sick
The Lelystad Youth Services (JEL) office remained closed all day Wednesday. Calls are not being answered; instead, an answering machine is playing. As a result, applications for youth assistance are not currently being processed. On Tuesday afternoon, the municipality suspended Director Tanja Boeije because an integrity investigation into her had begun. She was given until 3 p.m. to leave. Omroep Flevoland understands that Boeije then instructed her staff to cease their work and leave the building. A large number of employees reportedly decided to call in sick immediately and not go to work on Wednesday.

Anyone who tried to call JEL today heard a message on the answering machine stating that all staff members are currently on the line and that it is busy within youth services at the moment. Callers can leave their number to be called back within a day. The JEL parking spaces at the office on Het Ravelijn were all empty this afternoon.

No key
The municipality has appointed an interim director at JEL. He reportedly could not enter the building on Tuesday afternoon because the door was locked and all staff had left. Since the municipality does not have a key, the interim director would not have had access on Wednesday either. JEL, on the other hand, complained that since February 23, it no longer had access to files to issue decisions regarding specialized youth assistance. The municipal secretary is said to have revoked that authority because the municipal department wants to take control of it again. The city council will return from its election recess on Thursday evening for a special meeting to address this issue.

The municipality has not yet explained the nature of the reports against Tanja Boeije that prompted the launch of an integrity investigation. An independent agency will conduct this investigation. In a press release on Tuesday, the municipality stated that this agency requires “unrestricted” access to relevant documents and staff.

Source: https://www.omroepflevoland.nl/nieuws/462176/kantoor-jeugd-lelystad-dicht-medewerkers-hebben-zich-ziekgemeld

Russia Hacks WhatsApp and Signal Accounts of Government Employees, Intelligence Agencies Report
Russian state-sponsored hackers have likely obtained sensitive information through the WhatsApp and Signal accounts of Dutch government employees. This is according to the security services MIVD and AIVD. High-ranking officials, military personnel, and civil servants are being targeted by Russian hackers, who are attempting to gain access to their accounts on these messaging services. Journalists are also reportedly being targeted.

A spokesperson for the Ministry of Defense could not specify what information the Russians are specifically interested in. He referred to the annual reports of the security services. The MIVD’s 2024 report states that the Netherlands is an attractive target for Russia due to the role the Netherlands plays in supporting Ukraine and because important tech companies and organizations, such as the International Criminal Court, are based here. The AIVD’s 2024 report states that the Netherlands is a hub for data and transportation, and is therefore a potential target for the Russians.

Encrypted messages
The Russians are specifically trying to obtain users’ login credentials by posing as a chatbot for the messaging service Signal. This allows them to subsequently take over the user’s account and read along in chat groups. When this happens, users are unaware of it. According to the security services, the Russians are interested in chats on Signal because the messaging service is known for its reliability. It also offers the option to send encrypted messages, making it popular among government agencies. But that also makes it a place where Russians look for sensitive information.

No Vulnerability in the Messaging Service Itself
The MIVD warns that Signal and WhatsApp are not suitable channels for sending sensitive or confidential information, even though chats are encrypted.
The AIVD states that hackers do not exploit any technical flaws in the messaging services. Instead, they attempt to gain access through the security features of the messaging services themselves, for example, to obtain a user account’s PIN code. Therefore, this is not a vulnerability in the messaging apps themselves, but rather attacks targeting individual users.

Cybersecurity advice
According to the security services, Signal’s customer service never contacts users via the messaging service itself. If users receive a message that appears to come from Signal, it is likely from a hacker. The security services have therefore issued a so-called “cyber advisory” for users of messaging services. It explains how they can protect themselves against this type of Russian hacker to prevent unwanted eavesdroppers. Users can check for themselves if anyone is eavesdropping in the chat by looking to see if there are duplicate group members in the chats, for example with a slight difference in the username. If that is the case, one of the two accounts may have been hacked.

Taking Action
In that case, it is important to remove both the hacked account and the account that is still being used legitimately from the group, say the security services. Users of chat services are also advised to be alert to the names of group members who are not recognized by other members of the group. If this is not a legitimate user, they must be removed. If the group administrator has been hacked, everyone must leave the chat and a new chat must be started, the services say.

Source: https://www.binnenlandsbestuur.nl/digitaal/inlichtingendiensten-rusland-hackt-whatsapp-van-ambtenaren

 Crisis of trust in Erasmus MC’s ICU; inspectorate investigates work culture 
For years, a crisis of trust has existed between some staff members and the department’s leadership in the intensive care unit at Erasmus Medical Center, led by Diederik Gommers. Documents show that over the past five years, several ICU staff members have shared their concerns with the hospital’s ombudsman and the board of directors. They describe a toxic work culture and fear its potential impact on patient care.
The Health and Youth Care Inspectorate is currently investigating the work culture and held a meeting with the chair of the hospital’s board of directors several months ago. The inspectorate confirmed this in response to inquiries from NOS and Nieuwsuur. In addition, the hospital previously investigated three reports of patient emergencies. This was done at the request of the inspectorate. Those cases have been reviewed and are considered closed by the inspectorate.

'Structural evaluation'
The professional association Dutch Association for Intensive Care (NVIC) also visited the Erasmus ICU last year and issued a “strong recommendation”: the department must structurally evaluate the team’s performance, “with explicit attention to workload, collaboration, and the safety culture.” According to the NVIC, it is “essential” that signals from employees be taken seriously. This is evident from an investigation by the NOS and Nieuwsuur, in collaboration with the regional broadcaster Rijnmond, based on hundreds of internal emails and documents, a whistleblower report, and reports filed with the inspectorate. For the investigation, we spoke with 21 current and five former employees of the department. Three of them are sharing their stories with the NOS and Nieuwsuur for the first time:

'Medical specialists who fell out of favor were sent to a penal camp'
Over the years, a culture of fear has developed, which employees also report. “We discussed it with colleagues; we went to the ombudsman,” says intensive care physician Han Meeder. He is currently on secondment elsewhere. “I don’t know what else we could have done.”
Late last year, the board of directors received a whistleblower report from a specialist who has worked in the ICU for over twenty years. She stated that a lack of dissent has consequences for patient care. Resident physicians indicated in internal surveys that there is “tension” among the medical specialists, and that this affects medical discussions.

Professors of patient safety and doctors in the intensive care field call it exceptional that so many red flags are emerging within a single department. “That tells me that signals have been ignored for too long—signals that should have been addressed much earlier by a board of directors,” says Professor Jop Groeneweg. Emeritus professor of patient safety Jan Klein shares this analysis. Moreover, it can lead to sloppy handoffs or problematic communication between healthcare providers. “A poor work culture, by definition, affects patient care.”

Gommers lacks certifications
Our investigation also reveals that department head Diederik Gommers does not possess the certifications required in the Netherlands to conduct clinical research—specifically, invasive medical research on patients. According to industry regulations for academic hospitals, department heads must hold these BROK certifications. Regulator CCMO states in a response that the lack of such a certificate can never contribute to a safe environment for conducting research. Nor is this in the best interest of patients.

In a response, Erasmus MC states: “The lack of BROK certification has been discussed with the department head. He has started the course.” According to the hospital, Gommers has not conducted any clinical research since 2023. The hospital does not address the question of how many such patient studies Gommers was involved in without being certified.
Erasmus MC emphasizes that its own quality standards and investigations show no indications that patient safety in the ICU is at risk. The hospital board says it also bases this assessment on the National Intensive Care Evaluation (NICE) database. This database records extensive information about ICU patients, including deaths. But those NICE figures aren’t specific enough for that, experts say. “This concerns unsafe situations or suboptimal care for patients,” says Professor Groeneweg. “Care processes are difficult to capture in data.”

‘Too few people interviewed’
Emeritus Professor Klein says that qualitative research, in particular, can reveal a dysfunctional work culture. “That involves interviews with employees. And for that, you use a cross-section of your workforce.” But due to the whistleblower report, the study only interviewed medical specialists, not resident physicians or nurses. When Erasmus MC had the whistleblower report investigated by the consulting firm Berenschot, the scope of the investigation was limited: the report was not to be examined in its “entirety,” but the investigation was to be conducted based on “a limited number of interviews.” Based on that investigation, the hospital board concluded last year that the department head had not violated any rules of conduct and that the patient safety culture was “in order.” Several experts who reviewed the research design regarding the patient safety culture describe the approach as flawed. Only fifteen to twenty medical specialists were interviewed. “That way, you’ll never get to the bottom of it,” said Groeneweg.

Role of the Hospital Board
The whistleblower report also includes a complaint that the board of directors had been aware of the situation for years. Documents show that it received three reports from employees since 2021. The hospital confirms this. However, this complaint in the whistleblower report was ultimately not investigated. Groeneweg: “It is incomprehensible to me that a system administrator would not want their own role to be examined in an investigation into alleged misconduct.”

Source: www.nos.nl

Babies Evacuated After Flash Fire at Utrecht Children's Hospital
A number of babies were moved to another ward at the Wilhelmina Children's Hospital in Utrecht this evening due to a flash fire, according to a hospital spokesperson. The fire went out on its own and no one was injured. The incident occurred in the NICU, an intensive care unit for newborns. Six babies were transported to another location within the hospital.

The fire department received a report shortly after 9:30 p.m. and, as a precaution, escalated the response to a “major fire” level. After some time, the area was cleared by the safety region. According to the hospital, care for the children continued as usual throughout the incident.

Source: www.nos.nl

Over 800 gigabytes of data leaked from the municipality of Epe
 The cyberattack last Thursday on the municipality of Epe was carried out by professionals and initiated via a form of phishing known as ClickFix. Over 800 gigabytes of data were leaked. This amounts to approximately 600,000 files of varying sizes. The municipality reported this in an update.
ClickFix is a relatively new social engineering technique in which users are tricked into executing malicious commands on their own computers. During this cyberattack, they are shown, for example, a fake error message, a fake CAPTCHA, or an update notification. These messages claim that you can “fix” a problem by performing a simple action, often copying and pasting something. In reality, it is malware.

The municipality of Epe writes on its website: “We have modern security systems that block many attacks. However, this specific attack was clever and novel. We are now working with experts to investigate how this could have happened and how we can make our digital defenses even stronger.”
In this way, an internal network drive at the municipality was breached. It contained approximately 600,000 files containing many different types of information and data. Because there are so many documents, it will take a long time to determine exactly which data was leaked and from whom, the municipality states.

“We do now know that files containing personal data, such as names and addresses, have been leaked. As soon as more specific information is available, we will notify those affected by mail. Unfortunately, we do not yet know when that will be,” she stated in an online update.

Mayor Tom Horn: “Both residents and the Epe municipal organization have fallen victim to cybercriminals. I deeply regret that data has been leaked, particularly personal data. That is why we have filed a report with the Dutch Data Protection Authority. We are doing everything we can to personally inform those affected as carefully as possible. The cause and extent of the data breach are being further investigated.”
The municipality of Epe also notes that voting for the municipal elections on Wednesday, March 18, will be secure. They are receiving many questions about this.

Source: www.computable.nl

Third mouse found in Jumbo’s frozen green beans
A third dead mouse has been found in frozen vegetables sold by the Jumbo supermarket chain. Last Tuesday, a couple in Capelle aan den IJssel found the first dead animal in a bag of the store’s private-label green beans. That same day, a man from Swalmen (Limburg) contacted NU.nl with the same issue. Following the reports, Jumbo removed all frozen green beans from the shelves. The third customer immediately contacted the supermarket chain, Jumbo confirmed following a report by NU.nl. “We take this report very seriously and have immediately contacted the customer to offer our apologies,” said a spokesperson. It is not known when or where these frozen green beans were purchased.

Investigation
Jumbo will visit the customer to collect the vegetables and further investigate the incident. It is not yet clear how the pests ended up among the products. The supermarket chain is now conducting an investigation together with the supplier. Customers who have a bag of Jumbo green beans at home are asked to check the product. If they find anything unusual, Jumbo asks that they report it to customer service. If customers do not trust the green beans they purchased, they can return them to the store and receive a refund.

Source: https://nos.nl/artikel/2606995-derde-muis-gevonden-tussen-diepvriessperziebonen-jumbo
next page
Translated from Dutch to English with Deeple Translate

Don’t think it will not happen to your organization, but think about, when it will happen, what will be the impact.

  • Home
  • 1 st Quarter
    • January, click for totals or click submenu >
      • Headlines - January
      • Saftety warnings and recalls - January
      • Incidents - January
    • February, click for totals or click submenu >
      • Headlines - February
      • Saftety warnings and recalls - February
      • Incidents - February
    • March, click for totals or click submenu >
      • Headlines - March
      • Saftety warnings and recalls - March
      • Incidents - March
  • 2nd Quarter
    • April, click for totals or click submenu >
      • Headlines - April
      • Saftety warnings and recalls - April
      • Incidents - April