According to the Dutch Police, a phishing attack led to a security compromise, but its effect was contained, and public information was unharmed.

The agency’s security team is still investigating the event, and the attackers have been locked out of the affected systems.

“The police were targeted in a phishing scheme. Our Security Operations Center identified it quickly and immediately cut off access,” the police announced in a press statement on Wednesday.

“While the extent of the impact is still being assessed, it seems limited. The personal data of citizens and confidential information regarding investigations were not compromised. A criminal investigation has also commenced.”

The law enforcement organization hasn’t yet revealed when the intrusion was noted or whether any employee information was compromised during it.

A police representative didn’t immediately respond to BleepingComputer’s request for details about the occurrence, including specifics on which systems or accounts were affected and if any officer’s personal data was stolen.

In September 2024, the Dutch police also revealed a data exposure after a cyberattack potentially perpetrated by a “state actor” resulted in the theft of officers’ work-related contact details, such as names, email addresses, phone numbers, and, in some cases, private details.

An ongoing follow-up investigation is underway to determine the “nature, scope, and ramifications of the data release,” and the police have not publicly specified the threat actor responsible or the methods used in the attack.

After the prior attack, the police reported implementing stronger safeguards to avert similar incidents, including continuous monitoring of systems for unusual activity and mandating officers to authenticate into their accounts with two-factor authentication more often.

In February, Dutch authorities also apprehended a 40-year-old man for attempting to extort after the accidental sharing of confidential documents by the Dutch police.