Cyber Incident Victim: Nedap
Date:
Oct 2022
Location:
Netherlands
Summary
A hacker exploited a vulnerability in a Dutch healthcare portal operated by Nedap, compromising patient records from mental health clinics. The company addressed the security flaw immediately upon discovery, but subsequent investigations confirmed unauthorized access to sensitive personal data. This breach raised extortion concerns as stolen files containing confidential patient information fell into malicious hands, impacting numerous healthcare institutions relying on the system for digital health records.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 2 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On October 17, 2022, Netherlands-based technology company Nedap identified a security vulnerability in its Carenzorgt.nl healthcare portal, widely known as "Caren," which facilitated digital health record sharing for thousands of Dutch healthcare institutions. The company became aware of the flaw that morning and implemented immediate remediation measures to resolve it. Subsequent forensic investigations confirmed that malicious actors had exploited this vulnerability prior to its discovery, gaining unauthorized access to sensitive patient records stored within the system. Nedap publicly disclosed the breach on October 25 through an official press release, acknowledging the compromise of personal data belonging to patients of mental health clinics and other healthcare providers utilizing the platform. The portal, marketed with privacy guarantees, served as a critical infrastructure for transmitting confidential medical information across the Dutch healthcare sector.
The breach exposed patient files containing personal identifiers and medical details, raising concerns among affected individuals about potential extortion attempts by the perpetrators. Healthcare institutions relying on Carenzorgt.nl began notifying patients that their stolen data could be in the hands of threat actors, though the exact scope of accessed records remained unspecified in initial disclosures. The incident directly impacted mental health service users, amplifying anxieties due to the sensitive nature of their treatment histories. Nedap's investigation did not elaborate on the vulnerability's technical specifics or the duration of unauthorized access prior to detection. No ransomware deployment or immediate extortion demands were detailed in available reports, though the theft of medical records inherently created extortion risks. The company's disclosure emphasized prompt vulnerability mitigation but confirmed the exploitation had already occurred before their intervention.