Data Theft from Dutch Cancer Screening Lab Affects 485,000

A Dutch population health research agency is notifying 485,000 participants of a cervical cancer screening program of a July data theft from a clinical diagnostics laboratory that potentially compromised patients’ sensitive personal and health information, including lab test results.

See Also: Top 10 Technical Predictions for 2025

Research agency Bevolkingsonderzoek Nederland, or BVO NL, which oversees the national Dutch Population Survey screening programs for three types of cancer – breast, cervical and colon – in a statement Monday said that the “appalling” hack involved cybercriminals stealing and possibly leaking data from IT systems of Rijswijk, Netherlands-based Clinical Diagnostics NMDL laboratory, a subsidiary of Eurofins Scientific.

“This laboratory tests participants’ cervical smears and self-tests on behalf of the Dutch Population Survey, which conducts these studies on behalf of the National Institute for Public Health and the Environment,” the agency said.

The type of data of participants in the cervical cancer screening program potentially compromised includes name, address, date of birth, citizen service number, test results and the names of the participants’ healthcare providers.

“Participating in the cervical cancer screening program is already a stressful experience for many participants. And now you’re being told that your personal data may have been leaked as well,” said Elza den Hertog, chair of the BVO NL’s board of directors in the agency’s statement.

“We deeply regret that this has now gone so wrong at one of the laboratories we work with. An independent investigation has therefore been launched into how this could have happened and how we can prevent such incidents as much as possible in the future,” BVO NL said.

“We don’t know who currently has the data. Extensive, independent research is being conducted into the exact consequences of this hack,” the BVO NL said. “It’s possible for malicious actors to misuse illegally obtained personal data. Therefore, it’s important to always be alert to potential fraud. For example, be aware of unusual emails, apps and phone calls; don’t just click on links; and don’t share information over the phone,” the BVO NL is telling affected cancer screening participants.

Meanwhile, the BVO NL said it has temporarily suspended services from Clinical Diagnostics NMDL “until it is certain that processing new test results in the Clinical Diagnostics NMDL IT environment can take place safely.” Participants in the cervical screening programs will be analyzed by a different lab in the meantime, BVO NL said.

Clinical Diagnostics NMDL discovered the hack on July 6 and reported the incident to BVO NL on Aug. 6, according to an Aug. 11 letter sent by Danielle Jansen, Netherlands’ minister of health, wellness and sports to the country’s House of Representatives in Hague.

“I want to emphasize that the data breach did not affect the results of the cervical cancer screening program. Furthermore, I want to emphasize that BVO NL estimates that a temporary suspension of the collaboration will not jeopardize the continuity of the screening program,” Jansen said.

“In order not to adversely affect this ongoing investigation and any potential follow-up steps, such as a potential report from BVO NL, I cannot provide any further information about the hack itself at this time,” Jansen’s letter said.

Other Hacks

BVO NL’s public disclosure of the hack on Monday came the same day as the Dutch National Cyber Security Centre or the NCSC NL said several critical infrastructure organizations in the country were hacked by the attackers, who exploited the vulnerability in Citrix NetScaler, tracked as CVE-2025-6543 (see: Dutch Investigators Blame Multiple Threat Actors on Hacks).

Hackers compromised the Citrix memory overflow flaw in May. The NCSC and Citrix issued a patch alert. In July, the Dutch cyber agency uncovered evidence of potential exploitation, with several organizations disclosing system breaches to the agency. The agency launched an official probe into the breach at the end of July.

It’s unclear whether the hack on Clinical Diagnostics NMDL is related to the Citrix vulnerability exploitations reported to the Dutch NCSC NL.

Eurofins did not immediately respond to Information Security Media Group’s request for comment and additional details involving the hack on its Clinical Diagnostics NMDL subsidiary.

The cancer screening program hack also comes in the wake of several high-profile attacks on other European healthcare sector providers in recent months.

That includes a cyberattack last month on Swiss-based AMEOS Group, which operates more than 100 hospitals, clinics and rehabilitation centers across Europe, and also a June 2024 ransomware attack on British pathology laboratory services provider Synnovis.

The Synnovis attack disrupted patient care and testing services at several National Health System in England hospitals for months and triggered a nationwide shortage of type O-negative blood in the United Kingdom. NHS officials also blamed that attack to contributing to a patient death.