An investigation commissioned by the Ministry of Justice and Security found that the Public Prosecution Service's computer security had been inadequate for years before the 2025 cyberattack. It found that the service lacked a system to monitor suspicious activity on its own IT network. The attack occurred through a vulnerability in Citrix software used by employees to access the work network remotely. The final report by a committee led by Jaap Smit said it will take a long time to clear the backlogs caused by the attack. It also said substantial preventive work remains necessary to make the organisation more resilient to cyberattacks.