The Dutch waste-processing company Omrin suffered a cyberattack executed by the Russian hacking group Qilin on October 12. The breach resulted in the theft of highly sensitive personal data, including names, addresses, and BSN numbers (Dutch citizen identification numbers) of all 940 residents of the municipality of Schiermonnikoog. Additionally, over 1,000 GB of data was exfiltrated, encompassing confidential meeting protocols and private employee information. The municipality confirmed that Omrin had no legitimate need to store BSN numbers for its operations, exacerbating the severity of the incident. On October 30, cybersecurity experts discovered that a file containing resident personal data, local business information, and homeowner details from Schiermonnikoog was compromised. Affected individuals are being notified in writing about potential risks, including identity theft and fraud. Authorities are collaborating to mitigate the fallout, though the long-term reputational, financial, and operational consequences for Omrin and the municipality remain significant. The attack underscores critical lapses in data governance and cybersecurity protocols, with law enforcement actively investigating the incident.