Dutch Public Prosecution Service receives 118 reports following massive data breach at Clinical Diagnostics

During an investigation into a data breach at Clinical Diagnostics, a total of 118 victims have filed reports with the Dutch Public Prosecution Service.

In August 2025, the Centre for Population Screening disclosed that personal and sensitive information of 485,000 participants in a cervical cancer screening program had been stolen by a group of cybercriminals called Nova.

The attackers managed to obtain full names, addresses, dates of birth, citizens’ service numbers (BSN), test results, and the names of the participants’ healthcare providers from an external research lab.

In the following days, over 405,000 women who participated in the cervical cancer screening program received a letter from the Centre for Population Screening informing them that their data had been stolen due to a data breach at Clinical Diagnostics, the laboratory that collected and analyzed participants' samples.

Shortly after the incident, Clinical Diagnostics revealed that the scale of the breach was larger than anticipated. According to the research lab, the data of over 850,000 patients was compromised. This includes data from the Centre for Population Screening, as well as private clinics and general practitioners.

The Dutch Public Prosecution Service, which launched an investigation into the incident in the Summer of 2025, has received a total of 118 reports to date. The investigation is still ongoing and will probably take quite some time to finish.

“Investigating digital crime is always intensive and time-consuming, as evidence is complex and can come from anywhere in the world. Such investigations often require legal assistance from other countries before the police can take the next step. This makes it a lengthy process to identify a suspect,” the Public Prosecution Service said in a press release.

If it comes to an arrest and criminal proceedings, the Public Prosecution Service will decide what to do with the 118 reports. Those who filed reports will be informed in due course.

The data breach at Clinical Diagnostics is considered one of the most severe medical breaches ever in the Netherlands. That’s why two Dutch law firms have announced they will be filing a class-action lawsuit against the laboratory and the Centre for Population Screening.