Ing cover-ing: customer data possibly exposed at a hosting contractor

1. 2021-11-07

   The earliest unauthorized access found in the retained records. A mechanism allowing outside access to server files had been installed. [1]

2. 2026-10-24

   The contractor found intrusion traces during security checks. It confirmed exploitation of website software and installation of a malicious program. [1]

3. 2026-10-25

   The file-access mechanism was isolated and the affected systems were taken offline. [1]

4. 2026-10-30

   Ing disclosed the incident. [1]

Names, addresses, phone numbers, email addresses, orders and delivery details may be affected; the count is under investigation. No retained record confirms data removal, but gaps in the logs prevent Ing from ruling out access or acquisition. Card numbers are excluded because card data is handled on another server. [1]

Ing stopped the malicious program and access route and preserved evidence. It is reviewing software, access rights and log retention and monitoring with the contractor, and will contact affected people. The contractor is not named. [1]