Dutch KPN Certificate Authority Breached

Following Diginotar’s hack in September, another Dutch Certificate Authority has fallen victim to an attack. The CA, KPN, announced in a press release (in Dutch) that it has temporarily ceased releasing its certificates after discovering a DDoS tool on one of its servers. Although the tool may have been there for at least four years, the SSL certificates already issued remain valid.

Simultaneously, KPN has initiated an independent investigation involving experts from Logius, the digital government service of the Netherlands Ministry of the Interior and Kingdom Relations.

So far, no individual or group involved in hacking activities has claimed responsibility, which leaves room for even more speculation. Chances are that in this case the attackers are interested in compromising the certificates while also keeping a low profile, unlike Diginotar’s hack when the security breach was politically motivated to some extent.

Safe surfing everybody!

All product and company names mentioned herein are for identification purposes only and are the property of, and may be trademarks of, their respective owners.