Report a data breach
If you have discovered or suspect a security incident that may involve the unauthorized access, disclosure, alteration, or destruction of personal data, we ask that you report it to us immediately and responsibly.
Timely reporting helps us protect affected users, contain the issue, and comply with regulatory obligations under the General Data Protection Regulation (GDPR).
What to Report
Please report any incidents that may include (but are not limited to):
- Unauthorized access to systems or data
- Accidental exposure of personal data
- Lost or stolen devices containing personal information
- Misrouted emails containing confidential information
- System vulnerabilities with potential privacy impact
Responsible Disclosure Guidelines
If you’re a security researcher or a concerned individual, please:
- Provide a clear, detailed description of the suspected breach or vulnerability
- Include steps to reproduce (if known), or how you became aware of the incident
- Do not share any information publicly or with third parties
- Give us reasonable time to investigate and respond before any form of disclosure
We treat all reports confidentially and will acknowledge receipt of your report within 2 business days. Please note that urgent matters will be processed 24/7 by our standby security incident response team.
What Happens Next?
After receiving your report:
- We assess the scope and severity of the breach
- If applicable, we notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within the legally required time
- We take necessary technical and organizational measures to contain and mitigate the breach
- We inform affected parties when required
Your help in identifying and reporting potential data breaches is crucial to keeping our environment secure for everyone.
If you have any doubts or want to follow up on an earlier report, please contact our CISO via the CISO contact form.