On 10 March 2023, a malicious actor broke into the systems of Nebu, a software supplier for market research. This breach concerns consumer data from a number of Dutch market research companies that use Nebu's software, and it appears to include the personal data from about two million Netherlands residents. 

In total, 139 organizations has reported to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) that their customer data has been involved in this breach. The data breach seems to mostly consist of contact information such as name and email addresses, but also includes some income data, and in small number of cases it is possible that more sensitive personal information was included as well.

One of Nebu's client, Blauw, a qualitative market research firm, filed lawsuit against Nebu for inadequate information provision about this data breach. Blauw has some major clients including NS, VodafoneZiggo, CZ, Trevvel, and many more. According to Blauw, it takes 2 weeks for Nebu to report the data breach and, since then, Nebu is difficult to reach and hardly provides any information about the breach.

On April 6th, the court of Rotterdam ordered Nebu to provide information about the data breach to Blauw. Since Nebu has failed to indicate whether the data from (the clients of) Blauw has been stolen or not, the judge also ordered Nebu to conduct independent forensic investigation into the incident (source: privacy-web.nl). 

This data breach increases the risk of phishing attacks and other scams.  Malicious actors can use the stolen contact data to lure the victims into providing access to their accounts or worst, to make bank transaction. Therefore, it is very important for the victims to be notified about the breach in order for them to take action, such as changing their password, as soon as possible.

The fact that it takes Nebu over 2 weeks to report the breach left the victims exposed for too long. SOMI is currently investigating this case and we are determined to find out whether this breach has caused any damages to the people in the Netherlands. There might be a possibility for SOMI to initiate a claim on this incident.