Everyone should assume their personal details have already been leaked at least once or that it will happen in the future, and that means protecting your data as much as possible, the Dutch privacy watchdog Autoriteit Persoonsgegevens (AP) said on Tuesday.

The warning comes as the AP publishes its report on data privacy in 2022, which suggests that the number of leaks has not increased but that they have become more serious.

Last year the agency received 21,151 reports of data leaks, of which more than 1,800 were the results of a cyber attack.

These, the AP said, are more dangerous because they are the result of deliberate attacks by criminals looking for emails, names and other personal information which they can use to con consumers. In particular, the AP was alerted to over 6,000 cases of identity fraud in 2022.

“Unfortunately, data leaks are a continuing issue,” AP chief Aleid Wolfsen said. “And given their size and nature, everyone should assume that their details have already been leaked or that this will happen at some point… anyone can become a victim, even if you think you can’t.”

The AP was set up in 2018 to monitor adherence to Dutch privacy legislation. Since then the agency has received more than 114,000 reports of leaks, of which 6,500 were cyber attacks, which often involve more people.

For example, the three big healthcare leaks in 2022 resulted in medical information relating to 900,000 people becoming accessible, the agency said. Some 40% of the total leaks in 2022 were linked to the health and welfare sector.

By contrast, the number of leaks linked to financial services firms fell by 29% and accounted for some 9% of the total. Leaks via local government made up some 23%.

Healthcare firms were also at the centre of 23% of the cyber attacks.

Companies and institutions which are the subject of a cyber attack or a data leak are required by law to tell both the AP and people whose information may have been compromised.