Glossary term
Ransomware
Ransomware is malware that encrypts files and systems so they become unusable until a ransom is paid.
Read more
Significant cyber incident
Dutch cervical cancer screening lab breach, July 2025
In July 2025 hackers broke into a laboratory in Rijswijk that analyses cervical cancer screening tests for the Dutch national screening organization.
In short
In July 2025 hackers broke into a laboratory in Rijswijk that analyses cervical cancer screening tests for the Dutch national screening organization. By late August the number of people whose data may have been taken rose from 485,000 to more than 941,000, everyone whose data had been shared with the lab since 2017. The Dutch health inspectorate later found a compromised account without multi-factor login.
What happened
The laboratory analyses smear tests and self-tests for Bevolkingsonderzoek Nederland (BVO NL), the body that runs the national cancer screening programs. The lab found on 6 July 2025 that its information system had been hacked. It told BVO NL on 6 August. On 11 August the Health Minister told parliament that data of more than 485,000 participants had been taken. BVO NL suspended cooperation with the lab.
On 25 August the lab told BVO NL that nearly 230,000 more people were involved, and said it could not confirm this was the full extent. BVO NL then decided to inform everyone whose data it had ever shared with the lab since 2017, more than 941,000 people. Letters were delivered between 12 and 17 September 2025.
The data BVO NL shared with the lab were name, address, gender, type of test, date of birth, test results and the GP’s name, and for some participants the citizen service number (BSN). The minister said the breach did not affect screening results. The government named phishing and identity fraud as the main risks.
Timeline
-
3 July 2025
Forensic investigation shows unauthorized access first happened, according to the IGJ report.
-
6 July 2025
The lab discovers that its information system was hacked.
-
6 and 7 July 2025
New file servers are set up with screened backups.
-
8 July 2025
Lab work resumes after a break.
-
6 August 2025
BVO NL is informed of the data breach at the lab.
-
11 August 2025
The Health Minister informs parliament; data of more than 485,000 participants taken; cooperation with the lab suspended.
-
Week of 18 August 2025
Most of the 485,000 participants receive a letter from BVO NL.
-
25 August 2025
The lab tells BVO NL that nearly 230,000 more participants are involved.
-
29 August 2025
BVO NL says the breach is much larger than reported and will inform all 941,000 participants.
-
12 to 17 September 2025
The letters to all 941,000 participants are delivered.
-
16 December 2025
The Health and Youth Care Inspectorate visits the labs.
-
8 April 2026
The inspectorate's final letter report is dated this day.
How the attack worked
The main technical account is the Health and Youth Care Inspectorate (IGJ) letter report, which relies on what the lab told the inspectorate. The Dutch government sources opened do not name the attacker, and they do not say how the account was first compromised.
Step 1: A compromised user account
An outside investigation commissioned by the lab found that a user account was compromised. The lab could not establish how the account or its login details were obtained. At the time of the incident there was no multi-factor authentication on that account, according to the lab. This matches Valid Accounts (T1078).
Step 2: Remote desktop into an old environment
The account was used to reach a legacy environment through a remote desktop connection (Remote Services: Remote Desktop Protocol, T1021.001). This environment was due to move to a central one, and its data had not yet moved.
Step 3: Nobody was watching
The lab said the legacy environment fell outside the scope of monitoring by the laboratory group’s security operations center through a human error. The center wrongly believed it was no longer active and turned monitoring off, so unusual patterns in the logs were not noticed.
Step 4: Data taken
Unauthorized people reached data in the legacy environment. The lab said the integrity of data was not affected. The NCTV report calls the incident a ransomware attack in July. The IGJ report calls it an information security incident.
- Account compromisedA user account was compromised; how is not knownTechnique T1078 (MITRE ATT&CK, opens in a new tab)
- Remote desktop accessThe account was used to reach a legacy environment through remote desktopTechnique T1021.001 (MITRE ATT&CK, opens in a new tab)
- Monitoring offThe legacy environment was out of monitoring scope because of a human error
- Data takenPatient data of screening participants were reached; more than 941,000 people were informed
ATT&CK techniques
- Technique Remote Services Remote Services is when an attacker uses a valid account to log in to a service built for remote access, such as SSH, RDP or VNC. T1021 · Lateral Movement
- Technique Valid Accounts Valid Accounts means an attacker logs in with real credentials that were stolen or bought. T1078 · Stealth, Persistence, Privilege Escalation, Initial Access
Who says who was behind it
No public attribution in the official sources opened. The NCTV report calls it a ransomware attack (July 2025) and names no group. The IGJ report calls it an information security incident.
Impact
More than 941,000 participants in cervical cancer screening since 2017 were informed that their data were involved (BVO NL, 29 August 2025). Confirmed by the lab: 485,000 (early August) and nearly 230,000 more (late August). The lab could not confirm this was the full extent.
Data shared with the lab: name, address, gender, type of test, date of birth, test result, GP name, and the citizen service number (BSN) of some participants.
The lab was out of use for a short time; work resumed 8 July 2025. Cooperation between BVO NL and the lab was suspended. The government names phishing and identity fraud as the main risks. The contact center handled about 80 to 400 calls a day.
Government and regulator response
- 11 August 2025: the Health Minister told parliament; BVO NL set up a crisis team, suspended cooperation with the lab, reported the breach to the Data Protection Authority and the Health and Youth Care Inspectorate, and the RIVM asked the NCSC for help. An independent investigation was started.
- August to September 2025: BVO NL wrote to affected participants, first about 485,000, then to all 941,000 in four letter groups, delivered 12 to 17 September. The contact center was scaled up and a special information line opened.
- 16 December 2025 to April 2026: the inspectorate investigated information security at the labs and visited them on 16 December. The lab said it had appointed a CISO and aimed to be certified to NEN 7510.
Lessons
-
A supplier breach is your breach
The leak happened at a lab, but a national screening body had to write to 941,000 people. Suppliers that hold your data need the same controls.
-
Old systems are not safe because they are old
The attack hit a legacy environment waiting to be moved to a central one. Include them in monitoring until they are switched off.
-
Checking what is "inactive"
Monitoring was turned off on the basis of wrong information that the environment was inactive. Confirm with an asset list before turning logs off.
-
MFA on every account
The IGJ report says the compromised account had no multi-factor authentication when the incident happened.
-
Sizes can grow
The count rose from 485,000 to 941,000 within weeks. State what is known and say what is not.
What to check in your own organization
-
Remote desktop exposure
Find every system reachable by remote desktop and check who can log in and with what.
-
MFA coverage
List accounts that have no second factor, especially accounts on old systems.
-
Monitoring scope
Compare your list of systems with what your security operations center watches. Look for old systems.
-
Retiring old systems
Set deadlines for moving or shutting down legacy environments and keep them monitored until then.
-
Supplier security
Ask suppliers that hold personal data for evidence of audits against a recognized standard, such as NEN 7510 for Dutch healthcare.
-
Data minimization
Check what personal data you send to suppliers; the lab received BSN numbers for some participants.
-
Notification plan
Prepare letters, a contact center and anti-phishing advice before a breach, since the count may rise.
Where it happened
- Industry Healthcare and pharma Ransomware, stolen staff logins, patient data on leak sites and supplier exposure at hospitals and drug makers, and the rules that apply.
- Country Netherlands The Netherlands faces cyber espionage by Russian and Chinese state actors, ransomware, DDoS attacks and data leaks through suppliers. Europe
Questions
How many people were affected?
BVO NL informed more than 941,000 participants since 2017. The lab confirmed 485,000, then nearly 230,000 more, and could not confirm that was the full extent.
Who ran the lab?
A laboratory group subsidiary analyzing tests for Bevolkingsonderzoek Nederland.
Who was behind it?
The official sources opened name no attacker. The NCTV report calls it a ransomware attack in July 2025.
What data was involved?
Name, address, gender, type of test, date of birth, test results and GP name, and the BSN for some participants.
What did the inspectorate find?
A compromised user account with no multi-factor authentication, a legacy environment outside monitoring because of a human error, and no information security audit in the three years before.
Sources
- Kamerbrief datalek bevolkingsonderzoek baarmoederhalskanker (11 August 2025) Ministry of Health, Welfare and Sport (Tweede Kamer)
- Datalek veel groter dan eerder vermeld (29 August 2025) Bevolkingsonderzoek Nederland
- Update datalek bevolkingsonderzoek baarmoederhalskanker (September 2025) Bevolkingsonderzoek Nederland
- Antwoord op vragen van het lid Kathmann over de hack op een lab van Bevolkingsonderzoek Nederland (9 September 2025) Tweede Kamer
- Definitief briefrapport Inspectie Gezondheidszorg en Jeugd (8 April 2026) Health and Youth Care Inspectorate (Tweede Kamer)
- Cybersecuritybeeld Nederland 2025 NCTV
- Valid Accounts, T1078 MITRE ATT&CK
- Remote Desktop Protocol, T1021.001 MITRE ATT&CK
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.