Cyber Incident Victim: Netherlands
Date:
Mar 2022
Location:
Netherlands
Summary
A ransomware attack targeted The Sourcing Company, an ICT service provider for multiple Dutch housing corporations, compromising personal data including names, addresses, birthdates, national identification numbers, and bank accounts. Conti ransomware operators stole and published sensitive files, forcing partial network shutdowns that disrupted client services, limiting communication channels and tenant data access for affected housing providers. While some corporations confirmed limited data breaches, others reported no evidence of compromised tenant information. The incident was reported to the Dutch Data Protection Authority, with victims confirming engagement with the attackers but refusing ransom payments. Service restoration timelines remained unclear as recovery efforts continued amid ongoing operational limitations for client organizations.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 2 techniques |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On March 27, 2022, Dutch ICT service provider The Sourcing Company (TSC) suffered a ransomware attack attributed to the Conti group, resulting in the encryption of a portion of its servers. To contain the attack and facilitate recovery efforts, TSC proactively took additional network segments offline, causing widespread service disruptions for its housing corporation clients. The attackers exfiltrated sensitive personal data during the breach, including tenants' names, addresses, birthdates, BSN numbers (Dutch citizen service numbers), and bank account details. Conti subsequently published stolen files on its leak site. TSC initiated system restoration but provided no estimated recovery timeline, stating in a website notice that full operational recovery for clients remained uncertain. The company issued no further updates beyond its initial communication.
The attack impacted eight housing corporations relying on TSC's services: Alwel, Brederode Wonen, Laurentius, l'esceaut, Trivire, QuaWonen, De Woningstichting, and Zayaz. Investigations revealed compromised tenant data at multiple corporations, though the scale and confirmation of breaches varied. Zayaz confirmed attackers accessed or stored personal data for a small tenant subset, while Trivire asserted no evidence of its confidential data being leaked. Service disruptions persisted post-attack, with affected corporations reporting email and website unavailability, limited phone access, and inability to process tenant data normally. All impacted organizations notified the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) of the breach. Corporations engaged with the attackers but collectively refused ransom payment demands. Tenant notification processes remained pending as corporations worked to identify specifically affected individuals amid ongoing operational challenges.