Van Eijck International Car Rescue

Van Eijck International Car Rescue B.V. — a family-owned Dutch towing and recovery company with 225+ vehicles, 180+ employees, and 20 branch offices across the Netherlands and Spain. The exposed material includes: The Azure AD Connect service account password in plaintext — the credential that synchronises every identity between on-premises Active Directory and Microsoft 365. One password = control of the entire identity infrastructure. 9 KeePass password vaults (6 company copies + 1 MSP vault + 2 personal), distributed across IT admin home directories. If the master password is weak, the attacker owns every credential the company has. FortiGate firewall configurations for all 20 branch offices — admin password hashes, VPN pre-shared keys, RADIUS secrets, SNMP community strings, complete firewall rulesets, NAT tables, and internal IP architecture. 227 employee home directories (156 GB) containing personal documents, tax forms (loonheffingen), salary records, photos, and financial data. 12 GB of RentRunner customer rental contracts with copies of identity documents, driving licenses, and vehicle registrations. 10 years of customer claims data (2010–2019) — 500+ individual claims with damage assessments, insurance details, and customer PII. Complete Google Workspace backup (CubeBackup) — Gmail, Drive, and Calendar for 18 user accounts and 206 groups. The Unit4 ERP admin password (sysadm) in a plaintext INI file — 30+ financial databases accessible.