Almost 500,000 women in the Netherlands have had their medical information stolen after hackers breached a clinical laboratory responsible for analyzing cervical cancer screening tests. The stolen records, dating from 2022 until now, include names, addresses, dates of birth, social security numbers, test results, and even doctors’ follow-up advice.
The data was taken from Clinical Diagnostics, a lab located in Rijswijk, near The Hague. The breach occurred early last month, but the women involved and the national screening bureau were only informed last week. This delay sparked outrage, as European privacy laws require authorities and affected individuals to be notified within 24 hours of a confirmed data breach.
Bevolkingsonderzoek Nederland (BVO NL), the agency overseeing national cancer screening programs, strongly criticized the lab for failing to alert women sooner. Its chair, Elza den Hertog, described the incident as a “nightmare scenario.” She explained that while the bureau had worked hard to encourage women to take the cervical screening test, those efforts were undermined when participants learned their sensitive medical details had fallen into the hands of cybercriminals.
As a result of the breach, BVO NL has suspended its cooperation with Clinical Diagnostics until the lab can guarantee stronger protections for patient data. Dutch Health Minister Danielle Jansen has also ordered an independent investigation.
Further reports suggest the situation may be even more serious than initially thought. In addition to cervical cancer screenings, other laboratory data — including tests from hospitals such as Leiden University Medical Centre and Amphia may also have been compromised.
The healthcare cybersecurity center, Z-Cert, confirmed that stolen data has already appeared on the dark web, with around 100 megabytes published so far. That portion alone represents more than 50,000 patients’ information. Investigators believe the total stolen data could reach 300 gigabytes.
According to local media, a cybercriminal group known as "Nova" has claimed responsibility for the attack. Reports also suggest that the lab’s parent company, Eurofins Scientific, may have paid a ransom worth millions of euros in an attempt to prevent the release of the stolen files, though this has not been officially confirmed.
Authorities are urging affected women to remain alert to possible fraud. Stolen personal details can be misused for scams, phishing attempts, or identity theft. Officials advise patients not to share information with unknown callers, avoid clicking suspicious links, and treat unusual messages with caution.
“This incident shows just how damaging cyberattacks can be when they target critical healthcare services,” den Hertog said. “Our focus now must be on restoring trust, supporting patients, and preventing this from ever happening again.”
