Hackers stole personal data belonging to almost all of the 32,000 residents of the Dutch town of Epe in a cyberattack on a council server last month, local authorities have confirmed.

Names, addresses, dates of birth, places of birth and citizen service (BSN) numbers were taken for nearly every resident. Contact details and bank account numbers were also stolen from some, along with copies of at least 1,000 identity documents.

Those affected can replace their passport, ID card and driving licence free of charge, the council said. Residents whose ID copies were taken will receive a separate letter by 8 May.

No ransom demand has been made and the stolen data has not yet appeared on the dark web, mayor Tom Horn said. Police are investigating.

“People call it a leak, but it is theft,” Horn told broadcaster NOS, calling the breach a serious crime. “As a council, we are supposed to look after residents’ data properly and we take that seriously. Unfortunately, it has still gone wrong.”

Server used for submissions

The compromised server had been used since 2022 to collect documents submitted by residents – for example when making applications or lodging objections – before they were moved into the main system. No DigiD login details or passwords were taken, the council said.

The breach adds to a string of large-scale hacks affecting the Netherlands this year. Travel site Booking.com warned customers of a reservation data breach last week, and medical software firm Chipsoft confirmed earlier in April that patient data had been stolen in a ransomware attack on its systems.

A mass claim was also launched last week against telecoms provider Odido, whose February hack exposed personal data on 6.2 million people.