# Hackers steal customer data from Topbloemen and Toptaarten owner

> Topgeschenken, the online gift company behind Topbloemen and Toptaarten, says hackers stole names, addresses and email addresses in a cyberattack, but no bank or credit card details.

Society · published 2026-11-09 15:09 · updated 2026-11-09 20:32 · https://nlnow.nl/a/hackers-steal-customer-data-from-firm-behind-topbloemen/

Customers of Topbloemen.nl and Toptaarten.nl have had personal data stolen. Their owner, Topgeschenken Nederland, said on Monday that hackers struck on 5 November. Until then, all that was known was that the websites had been taken offline as a precaution. The company says it shut down part of its systems straight away. Its own website is still offline.

The stolen data includes names, addresses, email addresses, dates of birth and gender. It covers customers and the people they sent gifts to. The company says no financial data was taken: bank details and credit card details were not stolen.

The company has reported the incident to the Autoriteit Persoonsgegevens, the Dutch data protection authority, and says it will soon report it to the police.

The company's preliminary investigation shows that unauthorised people had access to systems holding company and personal data. They copied and exported part of that data. Topgeschenken says it found last week that outsiders had gained access to its IT environment.

Topgeschenken is now investigating how many people are affected and who they are. It says it will inform the affected customers once it knows. The company has also promised to communicate transparently and to share new information as it becomes available.

The stolen data also includes phone numbers, where customers and recipients had shared them with the company.

Existing orders are being delivered on time, the company says. Customers can currently place, change or cancel new orders only to a limited extent, or not at all. Because staff cannot reach all systems, customers may wait longer for answers to their questions.

## Background

- **Autoriteit Persoonsgegevens**: The Dutch Data Protection Authority is the independent government body that supervises how organisations in the Netherlands handle personal data under the GDPR and Dutch privacy law. It can investigate complaints, give guidance, and impose fines on organisations that break the rules. Organisations must report serious data breaches, such as theft of customer data, to it, usually within 72 hours of discovering them.

From NLnow, news from the Netherlands in English. How stories are made: https://nlnow.nl/about/