Stormous ransomware group lists katholiekamersfoort.nl on its leak site

• Ransomware group: Stormous
• Country: Netherlands
• Sector: Education
• Announcement date: June 2, 2026

Stormous claims data exfiltration against Katholiek Amersfoort

The ransomware group known as Stormous has announced a data breach involving the Dutch organization katholiekamersfoort.nl. In a post dated June 2, 2026, the threat actor alleges that it has successfully gained access to the institution's network infrastructure and has exfiltrated over 10 GB of data. This announcement, made on the group's leak site, marks a significant escalation in the threat landscape facing the organization.

According to the claims made by the Stormous group, the breach is not merely a disruption of services but a targeted theft of sensitive information. The group alleges that the compromised data pertains to a wide range of individuals, including donors, staff members, and a significant number of other individuals associated with the organization. While the group has made these claims publicly, no screenshots or additional evidence were provided in the initial announcement to verify the scope of the breach.

Details of the alleged compromised data

The information allegedly stolen by the threat actor is described as being highly sensitive and diverse in nature. The group claims to have accessed various types of digital assets that could be used for further malicious activities. The alleged compromised data includes databases, internal network shares, documents, contact lists, board and committee data, and system metadata. Furthermore, the group claims to have obtained Personally Identifiable Information (PII) belonging to the affected parties.

The specific categories of data identified in the group's claim include:

• Personally Identifiable Information (PII)
• Donor information
• Staff data
• Contact lists
• Board and committee data

The presence of system metadata and network shares in the claim is particularly concerning for technical security, as such information can often be used by attackers to map out an organization's internal digital environment for future exploitation.

About Katholiek Amersfoort

Katholiek Amersfoort is a religious organization that manages Catholic church communities and activities in the city of Amersfoort, Netherlands. As an entity managing community-based activities and religious services, the organization handles various types of sensitive information related to its members and participants.

Implications and organizational risks

This alleged breach may pose secondary risks such as identity theft and targeted phishing attacks for the individuals involved. Given the nature of the data, legal implications and compliance processes under the European Union's General Data Protection Regulation (GDPR) may arise. The politically motivated actions and data exfiltration methods of the Stormous group could lead to significant reputational damage for the organization. Furthermore, the leaked system metadata and network shares might provide a basis for further attacks against the institution's digital infrastructure. The group's past activities indicate a pattern of combining data theft with ransom demands.

In the broader context of cyber threats, this incident reflects the growing trend of double extortion, a tactic where ransomware actors not only encrypt an organization's data but also steal it to use as leverage. By threatening to leak sensitive information on public forums, attackers increase the pressure on organizations to pay ransoms. This approach is particularly effective against organizations that handle sensitive personal or community-related data, where the risk of reputational harm and legal penalties is high.

For organizations operating within the education or religious sectors, which often manage significant amounts of personal information, defensive measures are critical. Such measures typically include implementing robust multi-factor authentication (MFA), maintaining strict network segmentation to prevent lateral movement, and conducting regular security awareness training for staff to mitigate the risk of phishing. Additionally, maintaining comprehensive, offline backups and adhering to strict data minimization principles can help reduce the impact of a potential breach. As seen in this case, the theft of metadata can provide a roadmap for attackers, highlighting the importance of securing internal network documentation and infrastructure details.