Two arrested for selling data stolen from health board coronavirus systems

Two people have been arrested for selling private information gleaned from regional health board data bases used to share details of people who have had a coronavirus test, police confirmed on Tuesday.

The two are among a larger group of people thought to be accessing the confidential information and selling it to third parties and more arrests have not been ruled out, police said in a statement.

Broadcaster RTL has been investigating the sale of personal information via health board networks and reported its findings to the GGD health board association earlier this month.

RTL says not only names, addresses and phone numbers but also personal BSN numbers are up for sale. The information comes from two different data bases, one used in contact tracing and one for people who have been tested, and dozens of sources have been offering information from the data bases for sale via services like Telegram, Snapchat and Wickr.

‘Some accounts are offering to look for information about a specific person,’ RTL said. ‘That costs between €30 and €50 and will get you someone’s name, email address, phone number and BSN number.’ Other accounts offer bigger data sets involving thousands of names or specific attributes such as people living in Amsterdam or the over-50s.

‘This information can be used to commit identity fraud as well as phishing and stalking,’ IT law professor Frederik Zuiderveen Borgesius told the broadcaster. ‘And because the files may also include medical information, good security is extra important.’

Call centres

The two men, aged 21 and 23, were arrested at the weekend. Both worked for the health board (GGD) call centre used to track down the contacts of people who have tested positive for coronavirus.

The health board association was not aware of the illegal data trade and has now ‘immediately taken further measures’. Employees will also now have to submit a certificate of good conduct (VOG) and sign a confidentiality agreement, director Andre Rouvoet said. 

Random checks are also being carried out among employees and system monitoring will be scaled up.