DJI breach via Ivanti exploitation exposed staff contact, certificates and device location data

The Dutch Custodial Institutions Agency (DJI) disclosed a data breach and cyber incident after attackers exploited a security software vulnerability (Ivanti EPMM), maintaining access for months and exposing staff email addresses, phone numbers and security certificates of users of corporate phones, laptops and tablets. A 27 Feb 2026 letter to Parliament confirms device location data were also exposed. DJI notified the NCSC and instructed staff to disable location tracking; no service disruption has been reported.