GGD COVID-19 health data sale

In January 2021, the Netherlands' GGD (Gemeentelijke Gezondheidsdienst — the municipal health services responsible for COVID-19 testing and contact tracing) suffered a major insider-driven data breach. Call-centre staff with legitimate access to national pandemic systems stole the personal data of Dutch citizens and sold it on encrypted chat apps, exposing one of the most sensitive databases assembled during the pandemic.

What happened

The GGD operated two central COVID-19 systems: CoronIT, holding the personal details of everyone who booked or took a coronavirus test, and HPzone Light, a source-and-contact tracing system. To staff the national testing operation, the GGD rapidly hired thousands of call-centre workers — many of whom were granted broad access to these systems with limited vetting and weak monitoring.

In December 2020, journalists at RTL Nieuws discovered that personal data clearly originating from GGD systems was being advertised for sale on Telegram, Snapchat and Wickr. Sellers offered individual records — names, home addresses, email addresses, phone numbers, dates of birth and the BSN (Burgerservicenummer), the Dutch equivalent of a social security number — for roughly €30 to €60 per person, with bulk datasets of thousands of citizens sold for thousands of euros.

Impact

• The exposed fields, especially the BSN, are exactly what is needed for identity theft and fraud, making the breach unusually dangerous despite the absence of a technical "hack."
• Dutch police arrested two GGD call-centre employees on 23 January 2021, followed by a third suspect days later.
• The scandal triggered emergency parliamentary scrutiny and forced the GGD to acknowledge that the leak had been ongoing for months before detection.
• The GGD engaged Fox-IT to forensically review CoronIT logs and to monitor GGD GHOR logs until automated, continuous monitoring went live at the end of March 2021.

Why it matters

The GGD case is a textbook insider-threat and access-governance failure. The breach required no malware and no software vulnerability — just over-broad access, inadequate logging, and the absence of real-time monitoring across a hastily scaled workforce. It underscored that pandemic-era systems, built and staffed under extreme time pressure, concentrated highly sensitive national data without commensurate controls. The incident became a reference point in Dutch debates over health-data governance, the privacy risks of the BSN, and the need for least-privilege access and continuous audit logging in critical public systems.