At a glance
Our culture
Our organisation
Our history
Corporate governance
Our offering
Our business segments
Our market
Rights issue 2025
Why invest in Dustin
Our strategy
Our targets
Share information
Shareholder information
Reports and presentations
IPO
Financial calendar
Risks and risk management
Investor contacts
Email alerts
Financial data
Our targets
Climate
Circularity
Social impact
Commitments, memberships & certifications​
Policies for responsible business
Responsible procurement process
Business ethics, anti-corruption & whistleblowing
Data privacy
News & media
Financial press releases
Media contacts
Who we are
Why Dustin?
Your opportunities
How to join us
Open positions

UPDATES

(FAQ BELOW)

 

Update 260910 
Dustin confirms successful opening of websites and customer portals 
Following the IT security incident communicated on September 3, Dustin Group confirms that all websites and customer portals for placing orders are now available and operating normally again.

Since the incident was identified, Dustin has worked intensively to restore systems and services in a controlled and secure manner, with the highest priority to minimise impact on customers.

Dustin remains focused on serving customers and supporting partners across all markets, while the remaining recovery and remediation work continues. The IT forensic investigation of the internal and administrative systems that were subject to unauthorised access is ongoing to determine what data was involved. Dustin maintains regular contact with affected customers.

Update 260909
All websites are now open to customers. We are working on opening the customer portals as soon as possible.

Update 260908
Following the IT security incident communicated on September 3, Dustin Group has begun the gradual opening of affected systems. The opening is being carried out in a controlled and secure manner, with the highest priority to minimise impact on customers.

As a result of the progress made, the entire order flow is now up and running. For the time being, customers can place orders via phone and email and the work with opening web and customer portals as soon as possible is ongoing.

The IT forensic investigation of the internal and administrative systems that were subject to unauthorised access is ongoing to identify what data was involved. Dustin maintains regular contact with affected customers and continues to provide them with updates as the situation develops.

Update 260904
We are working intensively together with external experts to investigate the cause and extent of the incident. In parallel, we are working hard to safely re-open all systems.

Update 260903
Dustin investigates a serious IT security incident
Dustin Group has identified unauthorised access to some internal IT systems. The incident is considered serious and measures have been taken to limit the effects of the incident, including a temporary shutdown of certain systems. An investigation is ongoing, including investigations of a potential data breach, together with external cybersecurity experts.

Dustin has taken measures to protect its IT environment and is in contact with relevant authorities. We are working to re-open the systems we proactively have shut down in a controlled and safe manner and our highest priority is to minimise the impact on our customers. 
 

FAQ (this FAQ will be updated when applicable)  
FAQ table of contents

  • Questions regarding systems, orders, deliveries etc.
  • Questions about the incident 

  • Managed Services customers questions connected to personal data breach notification

    Questions on systems, orders, deliveries etc

    Q: Is it safe to collaborate with you via your systems? 

    A: Yes, we consider all open systems to be safe to use. All our websites and customer portals for placing orders are available, and operating normally again.

    Q: Are all websites and customer portals up and running again?

    A: Yes, all our websites and customer portals for placing orders are available, and operating normally again.

    Q: Does the incident impact placement of orders?

    A: No, all our websites and customer portals for placing orders are available, and operating as normally again. 

    Q: Does the incident impact delivery times? 

    A: No, our entire order flow is up and running and deliveries in the Nordics and Benelux are back to normal levels. 
     

Q: How do I contact you if I don't use the website? 

Belgium: 
Customer service: [email protected] / +3216796211 
Sales: [email protected] / +3216796200 

Denmark: 
Customer service: [email protected] / +4578712323 
Sales: [email protected] / +4578712323 

Finland: 
Customer service: [email protected] / +358306238501 
Sales: [email protected] / +358306238501 

Netherlands: 
Customer service: [email protected] / +31880118282 
Sales: [email protected] / +31880118282 

Norway: 
Customer service: [email protected] / +4721044030 
Sales: [email protected] / +4721044040 

Sweden: 
Customer service: [email protected] / +468553448 00 
Sales: [email protected] / +46855344553

Questions about the incident

Q: What data might be affected?

A: Our investigation is ongoing so we can’t share any specific information on that right now. Based on the information currently available and in the cases where it cannot be ruled out that personal data is affected, impacted customers have been notified. If our continued investigation show that data related to your organisation is impacted we will inform you as soon as we become aware. 

Q: Which actions do I need to take in terms of legal reporting?

A: Right now there are no actions you need to take, if the continued investigations show that data concerning your organisation is affected which makes it necessary for you to take action we will inform you as soon as we become aware.

Q: When do you expect the investigation to be finished?

A: We are working with the highest priority on this, but we cannot provide a date at this point.

Q: What actions have been taken?

A: To manage the incident, we immediately engaged leading cyber security experts for forensic analysis and containment of the incident. The incident has been reported to the relevant government authorities. A decision was taken to temporarily shut down certain systems with a clear plan for opening them up again as soon as possible.

Since September 9, all our websites are up and running as normal and as of September 10 customer portals for placing orders are open again. 

Q: Are you aware that the Jira dataset is published and possible to download?

A:Yes we are aware, we have downloaded it and we will bring it into our analysis.

Q: Has this incident been reported to the data protection authority?

A: Dustin has submitted an initial notification about the potential personal data breach to the Swedish data protection authority Integritetsskyddsmyndigheten ("IMY") in our role as a controller.

FAQ for Managed Services customers related to personal data breach notification(s)

Q: What is Skyportal/Okta?

A: Skyportal is the customer portal for our Managed Services customers providing you with information regarding your services and Okta is the platform used to authenticate users signing in to Skyportal.

Q: The personal data breach notification mentions Skyportal/Okta. Are there more systems where a personal data breach has been confirmed?

A: Currently, the investigation is still ongoing but we have no indication at this point that other systems than the ones already identified are affected.

Q: You mention personal data, what about other types of data and information in Skyportal/Okta that may be impacted? Has the investigation identified any potential exposure of technical data, including IP addresses, usernames, authentication tokens, audit logs, network information, device identifiers, or other metadata that could increase security risks for our organisation? 

A: Based on the information currently available, it cannot be ruled out that certain personal data that we process on your behalf in the system Skyportal/Okta has been accessed by an unauthorised party. Due to this, Dustin has an obligation under applicable data protection legislation to notify you as the controller about the potential impact on personal data. In regard to other data types, the investigation is still ongoing. We will continue sharing updates as the situation develops.

Q: What personal data does the Skyportal/Okta personal data breach concern?

A: Given that the personal data breach concerns Skyportal/Okta, the personal data that may have been affected corresponds to a limited number of non-sensitive business-related personal data categories for contacts and users of our business customers. This includes information relating to account names, user information, contact details to you as our business customer and user-generated data (such as logs and activity traces for use of Skyportal).

Q: Risk assessment of the Skyportal/Okta personal data breach: What risks does the personal data breach create for affected individuals?

A: Given that the personal data breach concerns Skyportal/Okta, the personal data that may have been affected corresponds to a limited number of non-sensitive business-related personal data categories for contacts and users of our business customers. Dustin has no indications that the affected personal data is of such a nature that it would be likely to result in a high risk to the rights and freedoms of the individuals concerned. These observations are based on the current status of the forensic investigation, which is still ongoing, and may be revisited as further information becomes available.

Q: What obligations do we as customer have now? / Which actions do I need to take in terms of legal reporting?

A: Personal data breaches - that are not unlikely to result in a risk to the rights and freedoms of natural persons – shall be notified to the relevant supervisory authority within 72 hours from becoming aware of the personal data breach in accordance with the requirements in the GDPR.

Dustin has no indications that the affected personal data is of such a nature that it would, in the normal case, be likely to result in a high risk to the rights and freedoms of the individuals concerned. These observations are based on the current status of the forensic investigation, which is still ongoing, and may be revisited as further information becomes available. We share this information with you to support your own assessment as controller and to keep you informed of developments in relation to the personal data breach.

Q: Can I get support from you in the actions I have to take?

A: We will continue to share relevant information about the incident and any significant developments as our investigation progresses. The information is intended to help you, as a customer and controller, understand the potential impact of the personal data breach and support any assessments that you may need to make.

Q: What is the difference between Dustin being a controller or processor of customer data?

A: When Dustin acts as a controller, Dustin determines the purpose and means of processing. This means that Dustin decides what personal data is collected, the purposes for which it is processed, and how it is used to deliver our own goods and services.

For some services, such as our Managed Services, Dustin acts as a processor, processing personal data solely on behalf of and under the instructions of you as a customer. This means that you as customer is considered the controller determining the purpose and means of processing, while Dustin provides a service that involves processing personal data on your behalf.