Dutch Data Protection Authority Affected by Ivanti Zero-Day Vulnerabilities

The Dutch Data Protection Authority (AP) reported a data breach linked to vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM) on January 29. The attack impacted employees of both the AP and the Council for the Judiciary (RVDR), with attackers possibly accessing personal information such as names, business email addresses, and phone numbers. Although the exact number of affected individuals was not disclosed, all impacted persons have been informed.

This incident stems from the exploitation of zero-day vulnerabilities, specifically CVE-2026-1281 and CVE-2026-1340, which the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed were actively exploited in the wild. The Netherlands’ cybersecurity agency (NCSC-NL) is monitoring these vulnerabilities, while the CIO Rijk office is assessing potential broader risks to the central government.

Ivanti’s security advisory indicated that only a limited number of customers were affected, but external sources, including the UK’s National Health Service (NHS), warned that EPMM devices are particularly vulnerable due to their internet-facing nature. The NHS emphasized that edge devices like EPMM are attractive targets for attackers, and vulnerabilities in such devices are likely to continue being exploited shortly after vendor disclosures.

Benjamin Harris, CEO at watchTowr, noted that EPMM devices are often used by high-value organizations, raising the stakes for cybersecurity. He advised that simply applying patches is insufficient, as organizations must assume that any exposed vulnerable instances are compromised and initiate incident response processes.

Implications for Organizations

This breach underscores the critical need for organizations to prioritize cybersecurity, especially regarding devices that are exposed to the internet. The rapid exploitation of vulnerabilities like those found in Ivanti’s EPMM highlights the importance of timely patching and proactive incident response.

Organizations should ensure that they are not only applying patches but also monitoring their systems for any signs of compromise. Given the nature of the data potentially accessed, affected organizations must communicate transparently with their employees and stakeholders about the risks and the steps being taken to mitigate them.