Dutch intelligence report says Russian hacker group stole data on 63,000 police officers, targeted NATO government systems

Cyber & Information WarfareCyber AttacksData theft / leaks

Aggressor

Summary

Russian hacker group 'Laundry Bear' stole data on 63,000 Dutch police officers and targeted NATO government systems across EU and NATO countries since 2024.

The Dutch General Intelligence and Security Service (AIVD) and Military Intelligence and Security Service (MIVD) reported that the Russian-affiliated hacker group Laundry Bear has conducted cyber espionage against government and commercial targets in the Netherlands and broader NATO/EU sphere since at least April 2024. The group stole sensitive data on nearly the entire Dutch police force—about 63,000 officers—alongside targeting NATO military, political, and high-tech sectors. The intrusions aimed at acquiring information on military equipment procurement and weapons supply lines to Ukraine, indicating strategic intelligence gathering benefiting the Kremlin. Laundry Bear employed multiple attack vectors including phishing, cookie theft, and password brute forcing, exploiting vulnerabilities in Microsoft Exchange servers. Microsoft's investigation named the group 'Void Blizzard,' which shares targets with other Russian-linked groups. The AIVD draws parallels with APT28 (Fancy Bear), associated with Russia's GRU, in tactics and target profiles. The exact espionage objectives remain unclear per the Dutch report.

Classification

Confidence: High

The article explicitly details Russian state-affiliated hacking group Laundry Bear conducting targeted cyber espionage and data theft against Dutch police and NATO/EU government systems, confirming aggressor activity with precise actors, timing, and methods.

Source URL

https://theins.press/en/news/281627

Open source

Provenance

Publisher: extension
Submitted: Apr 28, 2026, 19:29 UTC
Last updated: Nov 4, 2026, 08:35 UTC
Event time: May 27, 2025, 19:34 UTC

Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "5cb665d0-919d-4c5d-bdf1-8ae0a72ee2fe",
  "url": "https://theins.press/en/news/281627",
  "source": "extension",
  "status": "approved",
  "category": "Cyber & Information Warfare",
  "subcategory": "Cyber Attacks",
  "incident_type": "Data theft / leaks",
  "country": "Netherlands",
  "source_reliability": "B",
  "info_credibility": "3",
  "tags": [
    "Russian hackers",
    "Laundry Bear",
    "APT28",
    "Fancy Bear",
    "offensive cyber operations",
    "Dutch police data breach",
    "NATO cyber threats",
    "Microsoft Exchange exploit",
    "Void Blizzard",
    "EU intelligence"
  ],
  "nodes": [],
  "countries": [
    "Netherlands"
  ],
  "where_text": "Cyberspace",
  "headline": "Dutch intelligence report says Russian hacker group stole data on 63,000 police officers, targeted NATO government systems",
  "description": "A previously unknown Russian hacker group dubbed 'Laundry Bear' targeted government and commercial entities in the Netherlands and other NATO and EU countries for about a year from at least April 2024. The group stole sensitive data on approximately 63,000 Dutch police officers and conducted cyber-espionage against NATO, EU government ministries, defense departments, political parties, media outlets, and high-tech firms. Laundry Bear sought sensitive information on military equipment procurement and production as well as weapons deliveries to Ukraine. The group used hacking techniques including cookie theft, password brute-forcing, and phishing, and exploited Microsoft Exchange servers, with Microsoft naming the threat actor 'Void Blizzard.' Similar Kremlin-linked groups with overlapping targets include Seashell Blizzard, Forest Blizzard, Midnight Blizzard, and Secret Blizzard. The Dutch intelligence agencies (AIVD and MIVD) link Laundry Bear to Russia's GRU intelligence via similarities to APT28 (Fancy Bear).",
  "summary_short": "Russian hacker group 'Laundry Bear' stole data on 63,000 Dutch police officers and targeted NATO government systems across EU and NATO countries since 2024.",
  "summary_extended": "The Dutch General Intelligence and Security Service (AIVD) and Military Intelligence and Security Service (MIVD) reported that the Russian-affiliated hacker group Laundry Bear has conducted cyber espionage against government and commercial targets in the Netherlands and broader NATO/EU sphere since at least April 2024. The group stole sensitive data on nearly the entire Dutch police force—about 63,000 officers—alongside targeting NATO military, political, and high-tech sectors. The intrusions aimed at acquiring information on military equipment procurement and weapons supply lines to Ukraine, indicating strategic intelligence gathering benefiting the Kremlin. Laundry Bear employed multiple attack vectors including phishing, cookie theft, and password brute forcing, exploiting vulnerabilities in Microsoft Exchange servers. Microsoft's investigation named the group 'Void Blizzard,' which shares targets with other Russian-linked groups. The AIVD draws parallels with APT28 (Fancy Bear), associated with Russia's GRU, in tactics and target profiles. The exact espionage objectives remain unclear per the Dutch report.",
  "actor_primary": "Laundry Bear",
  "target_primary": null,
  "location_text": "Netherlands",
  "location_region": null,
  "location_coordinates_lat": 52.1326,
  "location_coordinates_lon": 5.2913,
  "location_precision": "Regional",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The article explicitly details Russian state-affiliated hacking group Laundry Bear conducting targeted cyber espionage and data theft against Dutch police and NATO/EU government systems, confirming aggressor activity with precise actors, timing, and methods.",
  "event_time_utc": "2025-05-27T19:34:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "exact",
  "created_at": "2026-04-28T19:29:00.250Z",
  "updated_at": "2026-11-04T08:35:32.139Z",
  "reliability_band": "strong",
  "location_precision_band": "regional",
  "time_precision_band": "exact",
  "severity_band": "significant",
  "attribution_confidence_band": "high",
  "attribution_basis": "independent_sources"
}

Public assessmentReliability: StrongSeverity: SignificantAttribution: HighIndependence confirmedTime: ExactLocation: Regional

Source reliability

Info credibility

Event time

May 27, 2025, 19:34 UTC

Event time confidence

exact

Location

Netherlands

Primary actor

Laundry Bear

Country

Netherlands

Countries

Netherlands

Tags

Russian hackers, Laundry Bear, APT28, Fancy Bear, offensive cyber operations, Dutch police data breach, NATO cyber threats, Microsoft Exchange exploit, Void Blizzard, EU intelligence

Loading signal...

{ "id": "5cb665d0-919d-4c5d-bdf1-8ae0a72ee2fe", "url": "https://theins.press/en/news/281627", "source": "extension", "status": "approved", "category": "Cyber & Information Warfare", "subcategory": "Cyber Attacks", "incident_type": "Data theft / leaks", "country": "Netherlands", "source_reliability": "B", "info_credibility": "3", "tags": [ "Russian hackers", "Laundry Bear", "APT28", "Fancy Bear", "offensive cyber operations", "Dutch police data breach", "NATO cyber threats", "Microsoft Exchange exploit", "Void Blizzard", "EU intelligence" ], "nodes": [], "countries": [ "Netherlands" ], "where_text": "Cyberspace", "headline": "Dutch intelligence report says Russian hacker group stole data on 63,000 police officers, targeted NATO government systems", "description": "A previously unknown Russian hacker group dubbed 'Laundry Bear' targeted government and commercial entities in the Netherlands and other NATO and EU countries for about a year from at least April 2024. The group stole sensitive data on approximately 63,000 Dutch police officers and conducted cyber-espionage against NATO, EU government ministries, defense departments, political parties, media outlets, and high-tech firms. Laundry Bear sought sensitive information on military equipment procurement and production as well as weapons deliveries to Ukraine. The group used hacking techniques including cookie theft, password brute-forcing, and phishing, and exploited Microsoft Exchange servers, with Microsoft naming the threat actor 'Void Blizzard.' Similar Kremlin-linked groups with overlapping targets include Seashell Blizzard, Forest Blizzard, Midnight Blizzard, and Secret Blizzard. The Dutch intelligence agencies (AIVD and MIVD) link Laundry Bear to Russia's GRU intelligence via similarities to APT28 (Fancy Bear).", "summary_short": "Russian hacker group 'Laundry Bear' stole data on 63,000 Dutch police officers and targeted NATO government systems across EU and NATO countries since 2024.", "summary_extended": "The Dutch General Intelligence and Security Service (AIVD) and Military Intelligence and Security Service (MIVD) reported that the Russian-affiliated hacker group Laundry Bear has conducted cyber espionage against government and commercial targets in the Netherlands and broader NATO/EU sphere since at least April 2024. The group stole sensitive data on nearly the entire Dutch police force—about 63,000 officers—alongside targeting NATO military, political, and high-tech sectors. The intrusions aimed at acquiring information on military equipment procurement and weapons supply lines to Ukraine, indicating strategic intelligence gathering benefiting the Kremlin. Laundry Bear employed multiple attack vectors including phishing, cookie theft, and password brute forcing, exploiting vulnerabilities in Microsoft Exchange servers. Microsoft's investigation named the group 'Void Blizzard,' which shares targets with other Russian-linked groups. The AIVD draws parallels with APT28 (Fancy Bear), associated with Russia's GRU, in tactics and target profiles. The exact espionage objectives remain unclear per the Dutch report.", "actor_primary": "Laundry Bear", "target_primary": null, "location_text": "Netherlands", "location_region": null, "location_coordinates_lat": 52.1326, "location_coordinates_lon": 5.2913, "location_precision": "Regional", "is_aggressor_signal": true, "signal_type": "HYBRID_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "The article explicitly details Russian state-affiliated hacking group Laundry Bear conducting targeted cyber espionage and data theft against Dutch police and NATO/EU government systems, confirming aggressor activity with precise actors, timing, and methods.", "event_time_utc": "2025-05-27T19:34:00.000Z", "end_time_utc": null, "event_time_confidence": "exact", "created_at": "2026-04-28T19:29:00.250Z", "updated_at": "2026-11-04T08:35:32.139Z", "reliability_band": "strong", "location_precision_band": "regional", "time_precision_band": "exact", "severity_band": "significant", "attribution_confidence_band": "high", "attribution_basis": "independent_sources" }