On 5 November 2026 we discovered that an unauthorised party had gained access to our platform and had viewed and possibly copied personal data.
As soon as we discovered the incident, we blocked the attacker's access and ended existing login sessions. We have also fixed the security problems used in the attack in key parts of our platform and taken extra measures to better protect our systems.
Our technical specialists are investigating the incident further and checking whether there are any other security problems. Where necessary, we take additional measures. We are also preparing an independent review of our security.
The data breach has also been reported to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). The investigation into its exact scope is still ongoing.
The data involved may include your name, contact details and, where available, address details and information about appointments and customer notes. An address can also be the address where a job was carried out. No passwords or payment details have been leaked.
At this moment we have no confirmation that the copied data has been made public. We cannot rule out misuse. That is why we advise you to be extra alert to unexpected messages, phone calls and payment requests.
The data can be used for targeted phishing and fraud. Criminals may pose as Zoofy or a tradesperson and refer to a previous job to win your trust. Even if someone knows your name, address or information about a job, that is no proof that the request is genuine.
The data breach has also been reported to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). The investigation into its exact scope is still ongoing.
No payment details have been leaked.
No passwords have been leaked.
The data involved may include your name, contact details and, where available, address details and information about appointments and customer notes. An address can also be the address where a job was carried out. No passwords or payment details have been leaked.
At this moment we have no confirmation that the copied data has been made public. We cannot rule out misuse. That is why we advise you to be extra alert to unexpected messages, phone calls and payment requests.
The data can be used for targeted phishing and fraud. Criminals may pose as Zoofy or a tradesperson and refer to a previous job to win your trust. Even if someone knows your name, address or information about a job, that is no proof that the request is genuine.
Carefully check unexpected payment requests and requests to pay to a different account number. Never share your password or verification codes.
If in doubt, do not click on links and hang up on a suspicious phone call. Type zoofy.nl into your browser yourself and use the contact details on our website to verify the request.
Keep the message and report it via [email protected]. In case of fraud, file a report with the police.
In case of financial fraud, contact your bank immediately and file a report with the police. Keep messages and proof of payment. Also report it via [email protected]. Do not send passwords, verification codes or copies of your ID with it.
According to the investigation, no customer passwords were obtained. If you use a password for Zoofy, you can change it as a precaution. Choose a unique password and never share your password or verification codes.
In doubt? Do not click on links in the message. Type zoofy.nl into your browser yourself and get in touch via the details on our website. A sender name can be faked. Never share your password, verification codes or payment details in response to an unexpected message.
Do you have questions about your data or this incident? Then email [email protected]. You can report suspicious messages or suspected misuse via [email protected].
If the investigation produces new information that is relevant to you, we will inform you.
The attacker exploited vulnerabilities in our platform. We have taken measures and are working on further improving our security. For security reasons we do not share technical details.
Customer data was copied in the attack. Which data was affected can differ per customer. In the email we sent, we stated which data it concerns. If you did not receive an email and you have checked your spam folder, your data has not been leaked. If you want more certainty, you can always email [email protected]. We are investigating the exact scope and will inform affected customers personally.
That differs per customer. The message you receive from us states which data may be involved. Do you have questions about your data? Then email [email protected]. After verifying your identity, we can handle your question personally.
As soon as we discovered the incident, we blocked the attacker's established access and ended existing login sessions. The identified security vulnerabilities used in the attack have been fixed. We have also tightened the controls on logging in, user rights and access to our APIs. Relevant access keys and other authentication data have been replaced or revoked.
Our technical specialists are investigating the incident further and checking whether there are any other security problems. Where necessary, we take additional measures. We are also preparing an independent review of our security.
We understand that you would have liked to know this sooner. After discovering the incident, we blocked the attacker's access and investigated which data was affected. We are informing you with the information that is available now. The investigation is still ongoing. If there is new information that is important to you, we will inform you by email. We share general updates through our official channels.
Data from previous bookings or registrations was also involved in the attack. That is why we also inform you if you have not used Zoofy for a long time.
This is a security notification about your personal data, not a marketing message. That is why you also receive it if you have unsubscribed from newsletters. Your unsubscription remains in place.
Even after a previous booking, certain data may still be needed for our administration. Would you like an explanation about your data, or do you want to request deletion? Then email [email protected].
Yes, email your access request to [email protected]. Where necessary, we verify your identity before we provide any data. Do not send a copy of your ID unprompted.
You can request deletion via [email protected]. We assess which data we can delete. If we have to keep certain data, we will explain why. This does not allow us to retrieve data that the attacker has already copied.
Email your request to [email protected] and describe what you want to know or have done. Where necessary, we verify your identity. You will receive a response within one month. For complex requests or a large number of requests, processing can take up to two months longer. We will inform you of this within the first month, stating the reason.