Quick links
Press Enter to search, Esc to close
Significant cyber incident
On 26 September 2024 the Dutch police told the Justice Minister that a police account had been hacked and that work contact details of all police staff, more than 62,000 people, were taken.
In short
On 26 September 2024 the Dutch police told the Justice Minister that a police account had been hacked and that work contact details of all police staff, more than 62,000 people, were taken. The AIVD and MIVD judged a state actor very likely responsible. In May 2025 they named a previously unknown Russian state-supported actor LAUNDRY BEAR and said other Dutch organizations were also hit.
On 26 September 2024 the chief of the Dutch police told the Minister of Justice and Security that the police had been hacked. A police account had been used to take the global address list, which holds the Outlook business cards of all police staff. The Tweede Kamer page says this covered the work contact details and some private details of all police staff, more than 62,000 people. The minister told parliament on 27 September.
The AIVD and MIVD had told the police about the incident. They judged it very likely that another country, formally a state actor, was responsible. The 9 October letter said some cards held private details, such as private phone numbers, that staff had entered themselves. The services and the police could not establish that other data had been taken.
On 27 May 2025 the two services published a report on a Russian state-supported actor they named LAUNDRY BEAR. They said their investigation into this actor began because of the police attack, dated 23 September 2024 in their report. They also said it is highly probable that other Dutch organizations were victims.
The police are hit by the cyber attack, according to the AIVD and MIVD report of May 2025.
The police chief tells the Minister of Justice and Security that the police were hacked.
The minister informs the Tweede Kamer by letter.
A second letter gives parliament further information.
A third letter says a police account was hacked and the global address list was taken; some private details were included.
The Public Prosecution Service has started a criminal investigation, carried out by Team High Tech Crime of the police.
The parliamentary committee for Justice and Security discusses the breach.
The AIVD and MIVD publish a report on LAUNDRY BEAR, a Russian state-supported actor behind the police attack.
The government letters give little technical detail. The AIVD and MIVD report of 27 May 2025 describes how the actor works in general. It does not say which of these methods were used at the police, so the steps below are the actor’s usual pattern, not a confirmed account of this case.
A police account was hacked. Through it the attacker took the global address list, with the Outlook business cards of all police staff. The services and the police could not establish that other information was obtained.
The services say the actor tries phishing, or authentication tokens and cookies bought on criminal marketplaces, to get in (Valid Accounts, T1078; Steal Web Session Cookie, T1539). It also uses password spraying, which tries a few common passwords across many accounts (Password Spraying, T1110.003). Once in, it downloads the global address list and uses it for more spraying against other accounts. It steals email at scale (Remote Email Collection, T1114.002). The services say it does not appear to use its own malware and relies on tools already on the victim’s systems.
The services say the stolen address list information may be used in later attacks, including spearphishing.
Who attributed it, and how firm it is
Attributed by the AIVD and MIVD, 27 May 2025, to a previously unknown actor they judge highly probable to be Russian state-supported and named LAUNDRY BEAR. In September and October 2024 the services only said a state actor was very likely responsible (Dutch government). The services also say LAUNDRY BEAR and APT28 are two distinct actors, so no APT28 link is made.
Work contact details of all police staff, more than 62,000 people, were taken, probably including photos or images (Tweede Kamer page) and, in some cases, private phone numbers and profile photos staff had placed in their cards (minister's letter of 9 October 2024). Email addresses of some chain partners were also taken.
The Dutch services and the police could not establish that other information was obtained. The Tweede Kamer page notes that officers were very worried about the stolen contact details.
The services warn the stolen address list can feed spearphishing and further password spraying. Treat contact data as sensitive.
The services say LAUNDRY BEAR uses simple techniques and tools already on victims' systems and stayed unseen for a long time.
The advisory recommends multifactor authentication so a password alone cannot open an account.
The police learned of the incident from the AIVD and MIVD. Keep a route open for such warnings.
The police attack led the services to a wider actor that, they say, probably hit other Dutch organizations too.
Check who can download the global address list and whether it can be fetched in bulk from outside.
Check that every mail account, including shared and delegated ones, needs more than a password.
Check that many failed logins spread across many accounts raise an alert.
Check that stolen session cookies or tokens cannot be reused from new devices without a new check.
Audit accounts that manage other accounts or have delegate permissions, as the advisory suggests.
Have a plan for staff whose private details are exposed: warnings, a contact point and phishing alerts.
Work contact details from the global address list for all police staff, over 62,000 people, and in some cases private details staff had put in their business cards.
The Dutch services and police could not establish that other information was obtained (AIVD and MIVD report, 27 May 2025).
In September 2024 the services said a state actor was very likely responsible. In May 2025 they named LAUNDRY BEAR, a previously unknown, highly probably Russian state-supported actor.
No. The police were informed of the cyber incident by the AIVD and MIVD (Tweede Kamer page).
The services see similarities in methods and targets but say LAUNDRY BEAR and APT28 are two distinct actors.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.