Dutch AP and Council for the Judiciary: data leak via Ivanti EPMM

Excerpt: On 9 February 2026, the Dutch Data Protection Authority (AP) and the Council for the Judiciary (Rvdr) confirmed a data leak caused by Ivanti EPMM flaws exposing professional contact details. Here is how a well‑governed MDM evidences GDPR 32 and NIS 2.

The facts

On 9 February 2026, the AP acknowledged being hit by zero‑day exploitation in Ivanti Endpoint Manager Mobile (EPMM, ex‑MobileIron). The same vector impacted the Raad voor de Rechtspraak (Council for the Judiciary). According to the government letter cited by the press, the 29 January 2026 attack potentially exposed staff data such as names, professional email addresses, and phone numbers. No precise volumes were disclosed, but affected individuals were notified. The mechanism: compromise of Internet‑exposed EPMM servers via critical vulnerabilities (CVE‑2026‑1281, CVE‑2026‑1340) that were actively exploited upon disclosure. Source: The Register references the letter to the Dutch Parliament and recalls the NCSC‑NL alert on EPMM.

European and national cybersecurity authorities issued urgent advisories, recommending an “assume breach” stance for any EPMM‑managed fleet, along with specific detection tools and emergency patches. See the CERT‑EU alert and advisories from NCSC‑NL and the Centre for Cybersecurity Belgium.

In short: the tool meant to secure and manage mobile endpoints became the entry point. For Luxembourg and EU leadership, the message is clear: a poorly governed MDM turns into a systemic risk.

Applicable legal framework

• GDPR, Article 32: obligation to implement “appropriate technical and organisational measures” to ensure a level of security appropriate to the risk (encryption, access management, logging, testing, etc.). In case of a personal data incident, the controller must demonstrate adequacy and effectiveness of its measures. Text: EUR‑Lex — GDPR. For an operational view, see the GDPR security requirements overview.
• NIS 2, Article 21: proportionate cybersecurity risk‑management measures covering device security, vulnerability management, monitoring, incident response and continuity. Text: EUR‑Lex — Directive (EU) 2022/2555. For the EU/LU context, consult the NIS 2 directive and its requirements.

For essential/important entities in Luxembourg (and their BE/FR/DE subsidiaries), the ILR and sectoral authorities will assess the ability to:

• prevent exploitation of exposed assets (MDM, gateways, etc.),
• rapidly detect compromise and contain its impact,
• notify the incident and document actions taken (GDPR 33/34, NIS 2 Art. 23 as applicable).

The technical solution to deploy

Focus: Mobile Device Management (MDM) × GDPR (BYOD) and NIS 2 (endpoint)

Goal: turn MDM from a “concentrated risk” into “evidence of control” by combining architecture, hardening, monitoring and forensics.

Key controls and implementation

• Segmentation and minimal exposure:
  • Place MDM/EMM behind a dedicated reverse proxy with TLS inspection, reduce exposed surfaces (only required URLs/APIs), enable mutual TLS where feasible.
  • Isolate MDM network/VMs from business systems, block unnecessary inbound flows. Map dependencies (DNS, SMTP, IdP) and enforce strict ACLs.
• Vulnerability management and “assume breach”:
  • Accelerated patching for MDM/Sentry components; automated regression tests; recurring maintenance windows.
  • Exploit detection: SIEM/EDR rules on vendor indicators (e.g., IoC paths, abnormal EPMM HTTP logs). Ingest artefacts from CERT‑EU/NCSC‑NL.
• Hardening and secrets:
  • Rotate MDM and Sentry gateway certificates/keys post‑incident; verify trust chain; separate admin roles.
  • Least‑privilege for integrations (IdP/Email/MDX). Deactivate legacy APIs; log all admin actions.
• Impact‑driven endpoint policies:
  • Mandatory encryption, strong lock, integrity attestation (Android/Apple); block jailbreak/root; business containers for BYOD.
  • Conditional access: block access to business data if posture is non‑compliant (OS version, security patch, bootloader).
• Evidence and traceability:
  • Secure retention of MDM logs (access, profile pushes, anomalies), streamed to SIEM for post‑incident review.
  • Targeted pentests of MDM exposure at least annually; tabletop exercises on MDM loss as an entry point.

Best‑practice references

• ISO/IEC 27001:2022 Annex A — A.8.1 (User endpoint management), A.8.9 (Configuration management), A.8.16 (Activity monitoring), A.5.17 (Authentication, per scope).
• NIST CSF 2.0 — PR.AC (Access Control), PR.PT (Protective Technology), DE.CM (Detection), RS.RP (Response Planning).
• CIS Controls v8 — IG1/IG2: 4 (Asset Management), 7 (Access Control), 12 (Vulnerability Management), 13 (Logging/Audit).

Legal evidence

• GDPR 32: scan reports, patch registers, access/admin logs, BYOD policies, test and exercise reports.
• NIS 2 Art. 21: vulnerability management policy, 24/7 monitoring, response plan, continuity, and performance indicators (MTTD/MTTR).

How Luxgap delivers this

• Our managed SOC: we ingest MDM/Sentry, IdP and email gateway logs into a correlated SIEM with Ivanti EPMM‑specific rules (CERT‑EU/NCSC‑NL IoCs) and “assume breach” scenarios. We provide 24/7 alerting and threat hunting (e.g., abnormal MDM admin creation, profiles pushed outside maintenance windows). Explore our managed SOC for incident detection.
• Our ISO 27001 governance: our Lead Implementers/Auditors structure the MDM/BYOD policy, architecture hardening, accelerated patching process, and the documentary evidence required by GDPR 32 and NIS 2 Art. 21 (procedures, KPIs, proofs).
• Our externalised DPO and CISO: framing of notifications (GDPR 33/34), impact qualification, and alignment of conditional access policies with data minimisation (BYOD) and proportionality.

Practically, we:

1. audit MDM/Sentry exposure and configuration,
2. implement a risk‑prioritised hardening/patching plan,
3. integrate logs into the SOC with ready‑to‑use rules,
4. run a response exercise simulating an MDM compromise,
5. deliver an evidence package usable by management and the DPO.

Use case in Luxembourg or the EU

A European financial institution subject to NIS 2 and GDPR operated an Internet‑exposed on‑prem MDM. In six weeks, we:

• segmented the MDM behind a dedicated proxy, removed unnecessary interfaces, enforced strong admin authentication;
• established an accelerated patch cycle and rotated Sentry certificates;
• streamed MDM/IdP logs to our SOC SIEM with CERT‑EU/NCSC‑NL IoC rules;
• hardened endpoint policies (encryption, minimal posture, non‑compliance blocking).

Result: measurable reduction of external exposure, automated detection of abnormal admin actions, and a GDPR 32/NIS 2 compliance dossier ready for audit.

First concrete steps

• Identify exposure: inventory all MDM/Sentry consoles, their versions and public surfaces (FQDN, ports). Block any unnecessary interface.
• Apply “assume breach”: if you run affected Ivanti EPMM, follow CERT‑EU/NCSC‑NL guidance, deploy detections, review the last 90 days of logs, and rotate secrets/keys.
• Accelerate patching: set a bi‑weekly MDM maintenance window and fast testing process; record evidence.
• Harden administration: phishing‑resistant MFA for all MDM accounts, named accounts, least privilege, tamper‑proof logging.
• Connect to the SOC: centralise MDM/IdP logs and alert on admin creations, profile pushes outside windows, and critical configuration changes.

For Luxembourg organisations subject to NIS 2 and GDPR, this technical and documentary alignment fits within the regulatory framework described in the NIS 2 directive and the GDPR security requirements.

Official sources

• News: The Register — Dutch data watchdog caught up in Ivanti zero‑day attacks (09/02/2026)
• EU alert: CERT‑EU — Critical vulnerabilities in Ivanti EPMM
• National alert (NL): NCSC‑NL — Actief misbruik Ivanti EPMM
• National alert (BE): Centre for Cybersecurity Belgium — Ivanti EPMM exploited
• GDPR framework: EUR‑Lex — Regulation (EU) 2016/679 (Art. 32)
• NIS 2 framework: EUR‑Lex — Directive (EU) 2022/2555 (Art. 21)