The data breach at Clinical Diagnostics appears to be even larger than initially thought. The Dutch Population Screening Organization reports that data from a total of more than 941,000 women may have been leaked, of which the laboratory currently confirms 715,000 cases. Clinical Diagnostics cannot guarantee that this is the full extent of the breach.
Bevolkingsonderzoek Nederland has launched several independent investigations to analyze the situation. An in-depth investigation at Clinical Diagnostics should reveal how the hack occurred and exactly what data was stolen. The Health and Youth Care Inspectorate and the Public Prosecution Service are also conducting criminal investigations into the cyberattack.
New revelations about the extent
On August 25, Clinical Diagnostics reported that another 230,000 participants in the cervical cancer screening program had been affected. This brings the total number of confirmed victims to more than 715,000 women, in addition to the 485,000 previously reported.
Population Screening Netherlands has decided to inform all women whose data has ever been shared with Clinical Diagnostics. A total of 941,000 letters will be sent out. The laboratory has been working with the organization since 2017, and data from all these women has been exchanged during that period.
Shared personal data
The exchange between the Dutch Population Screening Program and the laboratory concerns name, address and place of residence, gender, type of examination, date of birth, social security number, test result(s), and the name of the general practitioner. Email addresses and telephone numbers were not shared by the organization, but may have been leaked via other clients of the laboratory.
“This is once again alarming news for many people who have participated in the cervical cancer screening program,” said Elza den Hertog, chair of the Board of Directors of Bevolkingsonderzoek Nederland. “The amount of data leaked is shocking.”
The cervical cancer screening program is continuing through other laboratories that were not affected by this hack. Hacker group Nova previously promised to delete the stolen medical data, but the damage to the women affected remains.