Chinese espionage hackers penetrated Dutch military systems in early 2023, using a zero-day exploit in a Fortinet virtual private network to obtain access, Netherlands intelligence agencies disclosed Tuesday.

The agencies said the effects had been limited to a segmented network that had fewer than 50 users working on unclassified research and development with two-third party institutes.

The Military Intelligence and Security Service and General Intelligence and Security Service attributed the hacking to Chinese state actors with high confidence. The threat actor conducted reconnaissance of the network and stole a list of user accounts from the Active Directory server.