Dutch National Police: ‘Hackers probably used pass-the-cookie attack in recent data breach’

The massive data breach at the Dutch National Police, in which work-related and personal information of approximately 65,000 police officers was stolen, was most likely caused by a so-called pass-the-cookie attack.

“The goal of such an attack is to gain access to a user’s account or application without having to log in again using a password. A successful attack ensures that the attacker takes over an active session of an account with the associated rights,” both the Dutch National Police and Secretary of Justice and Security David van Weel say in a statement.

They state that initial access can be gained in many different ways, such as phishing. After a successful attack, malware can be installed that sends data, such as cookies, to a hacker, which he then can use to review or steal sensitive data. In this case, hackers stole the National Police’s address book, containing both work-related and personal information of all police officers working for the Dutch police force.

In a letter addressed to the parliament, Secretary Van Weel writes the police currently have no indications of concrete threats against any police officers or their families. Also, there’s no proof that any other data beside the global address list has been stolen.

“It is theoretically possible that the threat actor behind the hack links the stolen information to publicly available private data. There are currently no indications for this,” he adds.

It remains unclear who’s responsible for the data breach at the Dutch National Police. Intelligence and security agencies previously announced that a ‘state-sponsored actor’ was most likely behind the attack. Anonymous sources named Russia as the number one culprit for the incident.

The National Police have taken additional safety measures and are calling on all officers to remain vigilant.

“We all need to be aware of our digital vulnerability. That is part of today’s reality, also as a police organization. We simply cannot close ‘the door’ completely, but we can try to arm ourselves as best we can against cyberattacks. Substantial visible and invisible measures were taken immediately after the attack to protect us and we are continuously monitoring,” Stan Duijf, Head of Operations at the National Investigation and Intervention Unit, explains.