Nijhuis Bouw B.V.

Summary

A Dutch construction company was hit by a ransomware cyberattack in February, during which an attacker potentially exfiltrated personal data belonging to residents associated with its housing renovation projects, including names, addresses, and phone numbers. Although the company, working with specialist negotiators, obtained the attacker's commitment to delete the data and refrain from publishing it, it could not fully rule out that resident information had actually been stolen. The compromised computer systems were restored quickly and securely with the assistance of cybersecurity specialists, and the affected housing partner notified residents of the incident, advising them to remain vigilant against potential phone and email fraud attempts.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In February 2025, Nijhuis Bouw B.V., a construction company that had been performing work on a portion of the housing portfolio managed by De Goede Woning, was targeted in a cyberattack involving ransomware. The incident disrupted the company's computer systems and triggered an immediate response to contain the intrusion and restore operational capacity. De Goede Woning subsequently issued a public notification on 1 February 2025 to inform residents and other stakeholders about the breach, even though Nijhuis Bouw was the directly affected party. The notification confirmed the nature of the attack and outlined the broad categories of personal data that may have been exposed during the incident.

According to the published statement, the attacker is believed to have potentially exfiltrated personal information belonging to individuals associated with the housing project, including names, addresses, and telephone numbers. The organization noted that, while it believed the data of the specific residents being notified had not actually been stolen, it could not entirely rule out exposure. To manage the situation, specialized negotiators were engaged to communicate with the threat actor behind the ransomware operation. As a result of these negotiations, the attacker reportedly committed to deleting the data in question and refraining from publishing or distributing it online. The computer systems used by Nijhuis Bouw B.V. were also restored rapidly and securely in cooperation with technical specialists, allowing the company to resume its activities after a controlled recovery process.

In parallel with the technical remediation, affected individuals were advised to remain vigilant for potential fraud attempts conducted through telephone calls or email. The warning emphasized the importance of not clicking on suspicious links and never disclosing passwords or PIN codes, reflecting the typical social engineering tactics that may follow a data breach involving contact information. Residents who suspected fraudulent activity were directed to report incidents to the Fraudehelpdesk using the published phone number and website. For any direct inquiries related to the cyberattack or the handling of personal data, individuals were instructed to contact Nijhuis Bouw B.V. through the provided email address and telephone number. The organization's response combined technical restoration, negotiation with the attacker, and clear communication with potentially affected residents, reflecting a structured approach to managing the immediate consequences of the ransomware incident.

Sources

Sources available to members: 1 source.