Dutch Authorities Confirm Ivanti Zero-Day Exploit Exposed Employee Contact Data
Summary: The Dutch Data Protection Authority and the Council for the Judiciary confirmed to parliament that attacks exploiting Ivanti Endpoint Manager Mobile (EPMM) flaws exposed work-related data of AP employees, including names, business email addresses, and telephone numbers. Finland's Valtori disclosed a breach exposing work-related details of up to 50,000 government employees, identified on January 30, 2026, tied to a zero-day in the mobile device management service, with the corrective patch installed January 29, 2026, the same day Ivanti released fixes for CVE-2026-1281 and CVE-2026-1340 (CVSS 9.8).
What's compelling: Valtori's finding that its management system marked removed data as deleted rather than deleting it means device and user data from every organization that used the service across its lifecycle may be compromised - up to 50,000 government employees in that case alone.
Read the original at The Hacker News ↗
- Topics
- Privacy
- Mentions
- CVE-2026-1281CVE-2026-1340
- Related