# Gift sites Topgeschenken and Topbloemen reopen after data theft

> Topgeschenken, the company behind Topbloemen and Toptaarten, says customer data was stolen in a cyberattack and that all passwords have been reset.

Society · published 2026-11-10 14:13 · https://nlnow.nl/a/gift-sites-topgeschenken-and-topbloemen-reopen-after-data-theft/

The websites Topgeschenken.nl, Topbloemen.nl and Toptaarten.nl are working again, and customers can place orders. The company says a cyberattack on 5 November led to the theft of personal data.

**Why it matters**

- Topgeschenken has reset customers' passwords as a security measure.
- On their next order, customers must change their password before they can go on to payment.
- Some parts of the site, such as paying with gift cards, are not working yet.
- Customer service may take longer to reply because the company is receiving more messages than usual.

The stolen data are names and addresses, email addresses, dates of birth, gender and, where they were shared with the company, phone numbers of customers and any recipients. According to Topgeschenken, financial data such as IBAN numbers and credit card details were not stolen.

After discovering the incident, the company took part of its systems offline as a precaution. The sites have been back online since Tuesday, after extensive checks and extra security measures. The investigation into the attack is still under way.

Topgeschenken has reported the incident to the Autoriteit Persoonsgegevens, the Dutch data protection authority and says it will soon report it to the police. It promises to communicate transparently and to share new information as it becomes available.

The company is still working out how many people are affected and who they are. It says it will tell those customers once it knows.

## Background

- **Autoriteit Persoonsgegevens**: The Dutch Data Protection Authority is the independent supervisor that monitors whether organisations handle personal data in line with the GDPR (AVG) and the Dutch implementation act (UAVG). Organisations must report serious data breaches (datalekken) to it, and it can investigate, issue orders and impose fines. It is the point of contact for privacy complaints and for companies that have been hacked or lost customer data.

From NLnow, news from the Netherlands in English. How stories are made: https://nlnow.nl/about/