Screening agency Bevolkingsonderzoek Nederland has been fielding dozens of calls from women whose personal details were hacked at the test processing lab Clinical Diagnostics in Rijswijk.

The data accessed by ransomware gang Nova included the personal and medical information of almost half a million women who participated in screenings for cervical cancer going back to 2022.

The clinic has said all women will be informed tomorrow at the latest.

Tamara Hiddes, who had a smear test last year, already knows she is among the women whose data were hacked. “It’s very bad. This is important data. They have my name, date of birth, test results, and even my ID number. And you don’t know what they will use them for,’ she told broadcaster NOS.

Many of the callers asked for advice in case they get a suspicious phone call or email, helpdesk staff at the screening agency said. Experts said women could fall victim to scam emails or identity fraud.

Some of the data was put on the dark web and subsequently removed when Clinical Diagnostics paid an undisclosed amount.

However, the gang then accused the clinic of breaking a supposed promise not to involve the police, and threatened to put the stolen data online again unless a sum of €1.1 million is paid in the next 10 days.

Privacy rights and technology lawyer Sven van Dooren said several women had contacted him over concerns about their private information and their rights. “First, we need to find out if any privacy rules have been broken and what damage that has caused to those involved,” he said.

Privacy watchdog Autoriteit Persoonsgevens (AP) is currently investigating whether Clinical Diagnostics reported of the breach within the 72-hour window, and whether its clients could have been informed earlier.

If the clinic is found to have been in breach of privacy regulations, it could be fined up to €20 million or 4% of its revenue. Depending on the seriousness of the breach, companies could be banned from processing certain categories of personal data.