A newly identified Russian cyber-espionage group, Laundry Bear, breached the Dutch national police in September 2024. The attack resulted in the theft of work-related contact details of multiple officers, including names, email addresses, phone numbers, and some private personal data. The attackers gained access by compromising a police employee’s account and extracting contact information via the Global Address List (GAL) using a pass-the-cookie attack.

Dutch intelligence agencies (AIVD and MIVD) confirmed that Laundry Bear (Void Blizzard), a Russian state-linked hacker group, breached the Dutch National Police in 2023. The attackers successfully accessed the contact details of all police officers, compromising sensitive internal employee data. The operation was part of a broader espionage campaign targeting EU and NATO states, specifically aiming to gather intelligence on Western arms supplies and defense production for Ukraine. The breach was classified as extremely likely state-sponsored, with the group focusing on defense-related intelligence. While no immediate operational disruption was reported, the exposure of law enforcement personnel’s contact information poses severe risks, including potential targeted phishing, intimidation, or further cyber intrusions. Dutch authorities released technical findings to assist governments and defense contractors in mitigating future threats. The attack aligns with a pattern of Kremlin-backed cyber operations against Western logistics and military-supporting institutions, reinforcing concerns over state-level cyber espionage and its long-term strategic implications.