Dutch data watchdog snitches on itself after getting caught in Ivanti zero-day attacks

The Dutch Data Protection Authority and the Council for the Judiciary were compromised after attackers rapidly exploited Ivanti EPMM zero-day vulnerabilities (CVE-2026-1281, CVE-2026-1340) on January 29; personal data including names, business email addresses, and phone numbers may have been accessed. National and international agencies (NCSC-NL, CISA) and Ivanti have acknowledged active exploitation and are investigating, with warnings that internet-exposed EPMM instances should be considered compromised and remediated immediately.