Dutch authorities have confirmed cyberattacks exploiting vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM), exposing employee contact information at the Dutch Data Protection Authority (AP) and the Council for the Judiciary (Rvdr).
The National Cyber Security Center (NCSC) was alerted on January 29 after Ivanti disclosed the flaws. EPMM is used to manage mobile devices, applications, and security policies across government organizations. Attackers accessed work-related contact details, including employee names, business email addresses, and phone numbers.
Authorities said the incidents were reported to parliament, and affected employees were promptly notified. Mitigation measures were implemented immediately, while the NCSC continues to assess whether other government systems were impacted.
Separately, the European Commission disclosed a cyberattack on its mobile device management infrastructure on January 30. The intrusion may have exposed some staff names and phone numbers, but no mobile devices were compromised. The Commission contained and cleaned the affected systems within nine hours and is strengthening its cybersecurity posture as investigations continue. CERT-EU is also probing the incident.
Security experts warn that the exposed data could be used for targeted phishing, vishing, and impersonation attacks, enabling further credential theft and reconnaissance. The incidents also raise concerns over potential GDPR violations and reputational damage to affected institutions.
Comments