Waterbedrijf Groningen

Waterbedrijf Groningen, also known as Water Company Groningen, is a drinking water utility operating in the Netherlands. The organization’s headquarters is located in the Netherlands, specifically serving the province of Groningen. Its core activity involves the abstraction, treatment, and distribution of potable water to residential, commercial, and institutional customers. By ensuring water meets national safety standards, the company supports public health and daily life in the region. The utility operates under the framework of Dutch water legislation, which governs quality, supply, and environmental protection.

Waterbedrijf Groningen relies on a network of treatment plants, pumping stations, and pipelines to deliver water across its service area. The company monitors water quality continuously, conducting regular testing to comply with the Dutch Drinking Water Act. In addition to supply, it maintains infrastructure to minimize leaks and ensure efficient resource use. Customer service functions, including billing and communication, are often outsourced to specialized partners. One such partner is AddComm, which handles billing communications for the water company and other entities.

On May 17, 2024, Waterbedrijf Groningen announced a potential compromise of customer data stemming from a cyberattack on its supplier AddComm. The attackers initially deployed ransomware, attempting to hold data hostage, but the extortion effort was later thwarted. Despite the thwarted ransomware, there is a possibility that personal information of customers was accessed and exfiltrated. As of the announcement, the stolen data had not been published or sold, but the risk of misuse remained. The water company promptly notified the Dutch data protection authority and awaited a detailed impact assessment from AddComm.

In response to the incident, Waterbedrijf Groningen advised customers to remain vigilant against phishing attempts that could exploit any exposed personal data. The company emphasized that its own operational systems were not directly breached, and water supply services continued unaffected. Ongoing coordination with AddComm and regulatory bodies aims to clarify the scope of any data loss and to strengthen security measures. The episode highlights the reliance of utilities on third‑party vendors for ancillary functions and the associated cyber‑risk considerations. Waterbedrijf Groningen continues to fulfill its mandate of providing safe drinking water while addressing the aftermath of the supplier‑related cyber event.