SRA Reports Cyberattack on Retired File Servers; Historical Data May Have Been Accessed

Summary

SRA says a cyberattack targeted file servers decommissioned in January 2026. Historical data from 2023–2025 may have been accessed by unauthorized parties; the investigation is ongoing, and daily operations were unaffected.

Key points

• SRA detected the attack on April 9, 2026, and says it targeted file servers taken out of service in January.
• Historical data from 2023–2025 may have been accessed by unauthorized parties; the extent and impact are under forensic investigation.
• SRA says its daily operations were not affected.
• The file servers were shut down and disconnected, and SRA assembled a crisis team and engaged external forensic and legal experts.
• SRA reported the incident to the Dutch Data Protection Authority and informed members and other affected parties.