VIENNA (Reuters) – A Dutch hacker arrested in November obtained and offered for sale the full name, address and date of birth of virtually everyone in Austria, the Alpine nation’s police said on Wednesday.

A user believed to be the hacker offered the data for sale in an online forum in May 2020, presenting it as “the full name, gender, complete address and date of birth of presumably every citizen” in Austria, police said in a statement, adding that investigators had confirmed its authenticity.

The trove comprised close to nine million sets of data, police said. Austria’s population is roughly 9.1 million. The hacker had also put “similar data sets” from Italy, the Netherlands and Colombia up for sale, Austrian police said, adding that they did not have further details.

The Austrian information is so-called registration data – basic information including a current address that residents are required to provide to the authorities.

“Since this data was freely available on the Internet, it must absolutely be assumed that these registration data are, in full or in part, irrevocably in the hands of criminals,” the police said, adding that unknown people were believed to have paid for the data.

The 25-year-old suspect arrested in an Amsterdam apartment was known to international police and is under investigation by the Dutch police and judicial authorities, Austrian police said. A spokesman added that the statement was only published now so as not to hinder those investigations.

The police did not elaborate on the consequences for Austrians’ data security.

(Reporting by Francois Murphy