Data Dealers and Bomb Plots: Inside the Netherlands's Shadowy Market for Stolen Data

“Call me tomorrow, I will bring you the porridge,” read a text message sent one day in July 2024 to a civil servant in Amsterdam’s debt collection department.

But the sender wasn’t talking about breakfast. He meant money. And lots of it. 

The man who sent the text message, Rishi K., 41, was acting as a so-called information broker, according to Dutch prosecutors, who are mounting an unprecedented case against both him and the debt collection official for accessing troves of personal information on Dutch citizens. 

The broker is charged with paying the civil servant, Jim B., 47, for the home addresses and license plate numbers of a number of “subjects.” He allegedly accessed details of 2,625 such subjects so he could sell the personal information on to criminals, according to a report by the Dutch Public Prosecutor made public at an August hearing in the case. (The Public Prosecutor identified the accused only by their last initial, as is standard in many Dutch court cases.) It is unclear how many of these subjects' details were sold to the information broker specifically.

This case is part of a wider pattern. Dutch authorities have been struggling to deal with a wave of targeted explosions, assassinations and other brazen attacks fueled by organized crime over the last two years. Law enforcement officials now warn that criminal groups are increasingly infiltrating the Dutch state by using information brokers who are adept at cultivating networks of civil servants, then paying them to disclose personal data on prospective targets.

The attacks are not just violent, but carry a deeper and more unsettling message for their victims, according to experts: We know where you live, and who you’re tied to.

"There's a direct correlation between the personal data leaks and these attacks,” said Jeanine Kooistra, the head of the Dutch National Criminal Investigation Department in the Hague. “It is deeply concerning." 

Although she could not comment directly on the ongoing case, Kooistra told OCCRP that the attacks linked to data leaks are happening more often. 

“We’re seeing brokers whose revenue model is trade in government information,” she said. “They have recruited a network of civil servants with access to personal data.”

The brokers are “good at seeing who's vulnerable or sensitive to something: for nice things, women. Anything like that. They also recruit via social media”, said Kooistra.

A civil servant can make anywhere from 50 to 1,000 euros ($57 to $1,156) from selling one address or car license plate to an information broker, who will make around 500 euros ($578) per query, she said.

This is what allegedly happened in the civil servant's case, according to the Dutch Public Prosecutor’s Office. 

On May 12 this year, Dutch police arrested Jim B. on suspicion of corruption and abetting crime, specifically through his “complicity in causing explosions and other serious violent incidents,” according to the Public Prosecutor's report and a spokesperson for the office. 

Rishi K. and another alleged data broker were later arrested for allegedly bribing the civil servant and for complicity in four violent crimes each, and are in pre-trial detention, according to the prosecutor’s report. 

The arrests came as part of ‘28Ukelele,” an investigation that began in March this year when suspicions arose that the civil servant had accessed the Personal Records Database, containing the names, addresses, and other personal information of all Dutch citizens and non-residents. 

“Dozens of these inquiries were followed shortly thereafter by serious violent incidents,” according to the prosecutor’s report, which also alleges that he received over 100,000 euros ($115,000) for looking up information on more than 2,000 subjects.

Rishi K. admitted paying Jim B. 50 euros ($57) for each query, according to the prosecutor’s file. 

His lawyer, Eric Koolen, told OCCRP that he was now cooperating with prosecutors, and that he admitted having paid the civil servant for the data queries. Koolen described his client’s actions as “naive” and said he played “a small role” in the events described by the public prosecutor. “He simply didn't know what would happen to that data,” he said.

Some people, he added, don’t realize “that what they do has such huge consequences.” 

Jim B.'s lawyer declined to comment.

Both men have been charged by the public prosecutor and are now on trial at the Court of Amsterdam alongside the other alleged data broker, with another hearing in their ongoing case scheduled for October 17. 

The Public Prosecutor has not revealed to whom Rishi K. and the other alleged broker allegedly sold their data ahead of the attacks allegedly linked to the civil servant. (Rishi K.'s lawyer told OCCRP that his client provided addresses from the civil servant to only three people.)

This is the first time a civil servant has been charged with complicity in a wave of serious violent crimes, according to the Public Prosecutor. 

The news that one of their own has been accused of abetting crime hit Amsterdam’s municipal employees “like a bombshell,” the Public Prosecutor’s report said, adding that “his department head and team manager call him a dedicated and loyal employee, someone you could always rely on. According to his team manager, his closest colleagues were in tears because they couldn't believe it.” The municipality declined to comment.

The case is also unique because of the scale of violence prosecutors allege was set off by the civil servant's sale of information.

‘Trapped in a Web’

A surge of shootings and explosions across the Netherlands in the last two years has been partly fueled by feuds between rival drug gangs, experts say.  

More than 1,500 explosions — or attempts at setting off explosions — took place across the country last year, an increase of 71 percent from 2023. In the port city of Rotterdam, about half of all explosions and other violent incidents were tied to conflicts in the criminal underworld, according to a 2024 report from the Rotterdam police. 

Prosecutors allege Jim B.'s sale of personal data was responsible for at least six of these incidents, in six different cities around the Netherlands.

According to the Public Prosecutor's report, he called up information on two houses that were both later bombed in October 2024. The Public Prosecutor said in a statement that these explosions were likely linked to a major cocaine heist in the Belgian port city of Antwerp, a key node for criminals smuggling cocaine from Latin America. 

During the heist, a group of thieves stole a shipment of 1,400 kilograms of cocaine and transferred the drugs to locations across the Netherlands, according to the statement.

A boom in cocaine trafficking in Europe over the past decade has meant that “never before has organized crime had so much venture capital available to invest in corruption,” said Daniel Brombacher, who leads the Global Initiative against Transnational Organized Crime’s work in Europe.

This has led to what he described as the rise of a “brokerage culture” in which a new class of criminal service providers gets paid to arrange strategic leaks of information. 

The rise of encrypted communications tools has also made it easier for groups to obtain this type of information, Brombacher said.

According to public prosecutors, Jim B. and Rishi K. communicated via the encrypted app Signal, as well as a web service called Privnotes, which allows users to send “self-destructing” notes. The Privnotes were used to share the results of the data queries Jim B. made.

At the end of last year, the prosecutor’s report says, Jim B. texted Rishi K. about an apparent overdue payment: “But bro, when are we settling the bill. Because it's getting quite a lot now. And it seems like I have to chase my money every time again. I have to provide information again and again, and I am waiting.”  

And then another bomb went off.

It was the middle of the night in a large Dutch city earlier this year when Mary and her husband Paul awoke to the sound of an explosion ripping their front door off its hinges. 

The police later said the bomb had targeted their neighbor. 

The couple, who are migrants to the Netherlands in their 60s, live in a working-class neighborhood. They spoke to OCCRP on the record, but their names have been changed because of the ongoing security risk. 

Mary panicked and hid. No one was hurt, but she was close to the explosion. 

“I am still stressed when I think about it,” she recalled of the incident 

It is not clear who targeted Mary’s neighbor, or why —  or even if the perpetrator was affiliated with organized crime. But Jim B. is allegedly responsible for providing information that led to the explosion, according to the public prosecutor’s report. 

The report said that when he was arrested this May, police entered the house where he lived and found an iPhone, a Motorola G13, and a handwritten note on the table reading: 

The Public Prosecutor alleges that this note shows the amount of money the civil servant had made by selling private data from municipal databases to criminals. 

According to the public prosecutor, he allegedly provided personal information that led to a daylight shooting in the Hague, and explosions targeting residential houses in around six cities in the Netherlands occurring between October 2024 and May 2025, including the explosion targeting Mary and Paul’s neighbor.

Details of an explosion at a shelter for people in crisis last December found in police reports also match the information provided by the Public Prosecutor about an explosion linked to data leaks from the civil servant. 

Although Jim B. declined to comment, he told police investigators: “I felt trapped in a web from which I could no longer escape,” according to the public prosecutor’s report.

The report recounted how an inspector asked him "if he knew his information was being used for violent incidents reported in the media, for example, to launch [houses] into the air." He replied that he was aware.

While the court case is ongoing, the victims of explosions still live in fear. 

Mary and her husband Paul are still struggling with the aftermath of the explosion in front of their home. Mary never fully got the black soot out of her curtains, even though she washed them thoroughly. The couple had to put a new front door in and repaint the walls, but a burn mark remains from the blast on their bedroom wall.  They want to move, but that is easier said than done . 

Meanwhile, the explosions have not stopped. Mary’s husband Paul was making coffee recently when yet another bomb went off outside their building. Mary said she is frightened that it could happen again.

“It is super-dangerous. It happened so close to our door. It could happen anywhere.”

Clarification: This story was updated to refer to the two accused men by their initials.