Dutch police disclose phishing breach, say impact limited and citizen data not exposed
The Dutch National Police say a March 2026 phishing attack was caught fast by their SOC with no citizen data exposed, after a 2024 pass-the-cookie hack.
The Dutch National Police (Politie) said in March 2026 that a phishing attack had led to a security breach. They described the impact as limited and said no citizen or investigative data was exposed. Few details have been released. The case is still worth reading alongside the force's 2024 breach, in which a stolen session cookie gave Russian state hackers access. Together they show the two ways attackers most often get into organisations that already use MFA: phishing and token theft.
What happened
In a statement on Wednesday 25 March 2026, the police said they had been "the target of a phishing attack". Their Security Operations Center spotted the intrusion quickly and cut off the attacker's access. The police said the impact "appears to be limited", that citizens' data and investigative information weren't exposed or accessed, and that they had opened a criminal investigation. They didn't say when the attack started, which systems or accounts were affected, or whether employee data was involved.
This is the second publicly disclosed breach at the force in under two years. In September 2024 attackers stole work contact details (names, email addresses, phone numbers and in some cases private information) for many officers from the organisation's Global Address List. In May 2025 the Dutch intelligence services AIVD and MIVD attributed that attack to a newly named Russian state-backed group, Laundry Bear, which Microsoft tracks as Void Blizzard. Investigators said the attackers probably used a "pass-the-cookie" technique: they bought an employee's session cookie, stolen by infostealer malware, on a criminal marketplace and used it to log in without a password or MFA prompt.
After the 2024 incident the police said they had added continuous monitoring of all systems and required officers to re-authenticate with two-factor authentication more often. BleepingComputer also noted that in February Dutch authorities arrested a 40-year-old man who tried to extort the police using confidential documents the force had shared by mistake.
Who is affected
- Based on the police statement, citizens' data and investigation files weren't affected.
- Police employees may be affected, but whether staff data was accessed hasn't been disclosed.
- No software products or versions are involved. This is an account-compromise incident, not a vulnerability.
What it means for developers and engineering teams
The quick detection is the encouraging part. A SOC that catches a phished account before data leaves turns a potential breach into a contained incident. But the two incidents together show that standard MFA doesn't fully solve the problem. Phishing kits now commonly proxy the real login page (adversary-in-the-middle) and capture the session token after the user completes MFA. Infostealers grab the same tokens straight from the browser. Either way, the attacker ends up with a valid session, not just a password.
For teams that build or run internal applications, that changes where to focus: how long sessions last, whether tokens are tied to a device, how quickly you can revoke them, and whether directory data such as a global address list is readable by every account by default. One compromised account shouldn't be able to export the whole organisation's staff directory.
What to do now
- Move privileged users to phishing-resistant MFA (FIDO2 security keys or passkeys), which a proxy phishing page can't relay.
- Shorten session and refresh-token lifetimes for admin portals and email, and require re-authentication for sensitive actions.
- Use conditional access that checks device compliance, so a stolen cookie replayed from an unmanaged device fails.
- Alert on session anomalies: the same session used from two locations or devices, or sudden bulk directory or mailbox access.
- Practise mass revocation: know how to revoke all sessions and refresh tokens for a user in your IdP and key SaaS apps within minutes.
- Restrict directory exports and bulk Global Address List queries to the roles that need them.
Related on TechLogHub
- Authentication: MFA, sessions and their weak points
- JWT: how bearer tokens work and why theft matters
- Clerk vs Auth0: managed identity platforms compared