Dutch Authorities Hit by Ivanti Zero-Day Exploits
Learn More
The Dutch Data Protection Authority (AP) and the Council for the Judiciary (Rvdr) confirmed their systems were compromised by cyberattacks exploiting zero-day vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM). The breach, disclosed in a notice to the Dutch parliament on February 6, 2026, also impacted the European Commission and Finland's state ICT provider, Valtori.
The compromised data includes:
- Full names of government and agency employees
- Business email addresses
- Work telephone numbers
- Mobile device details and metadata
- Historical user records and device logs
The number of affected individuals for the Dutch agencies are not disclosed. The Dutch National Cyber Security Center (NCSC) alerted agencies on January 29, 2026, the same day Ivanti released corrective patches.
