Government Domain Hijacking: How the Dutch Lost Control of an Official .NL Domain

By Geert de Graaf | July 2026

---

TL;DR

A 2010 Dutch government letter instructed citizens to contact www.infoEPD.nl for help with medical data sharing objections. The letter listed an official government phone number. Today:

• The phone number is a dead line (verified: July 2026)

• The domain is owned by a commercial SEO company, not the government

• The site now hosts generic link directories (travel, shopping, sports) with zero government affiliation

• The government program was abandoned just 11 months after the letter

What went wrong? The government chose a generic .nl domain instead of a protected government TLD, failed to maintain it when the program ended, and left citizens with no way to contact them.

---

The Original Letter

In December 2010, Dutch citizen G.J. de Graaf received an official letter from the Ministry of Public Health, Welfare and Sport (Ministerie van Volksgezondheid, Welzijn en Sport).

The subject: confirmation that their objection to sharing medical data via the national electronic patient dossier (EPD — Elektronisch Patiëntendossier) had been processed.

The letter provided clear instructions on how to revoke this objection:

• Website: www.infoEPD.nl (mentioned 4 times in the letter)

• Phone: 0900-232 43 42 (1 cent per minute)

• Email: servicedesk@infoepd.nl

• Organization: Informatiepunt landelijk EPD (a joint venture between the Ministry and Nictiz)

Straightforward. Official. Trustworthy.

---

The Problem: Generic TLD for Government

In the Netherlands, we allow anyone to register a .nl domain for a few euros per year. It's a democratic system — perfect for businesses, individuals, and community projects.

But not for critical government services.

Most countries protect government communications with dedicated TLDs:

• United Kingdom: .gov.uk (protected)

• France: .gouv.fr (protected)

• Belgium: .gov.be (protected)

• Netherlands: .overheid.nl (available since 2008, but apparently not used for this critical service)

Instead, the Ministry of Public Health chose a generic .nl domain. Anyone could theoretically register infoepd.nl if the government's registration expired. And that's exactly what happened.

---

What Changed: A Timeline

---

The Current State: Hijacked by Commerce

Today, visiting www.infoepd.nl reveals a commercial link directory operated by IMEZO, a Netherlands-based SEO and online marketing company.

Domain Ownership Details (from SIDN WHOIS Registry)

What the Site Shows Now

• Navigation: Home, Daughters, Contact

• Content: Articles like "Flying from Schiphol during summer vacation"

• Categories: 20+ unrelated topics (travel, sports, shopping, health)

• Subsites: bedrijven.infoepd.nl, nederland.infoepd.nl, regionaal.infoepd.nl

There is no mention of medical data, EPD, or government services.

---

The Company Behind the Domain

IMEZO is a full-service internet marketing bureau based in Huizen, Netherlands. Their business model:

• Create high-traffic link directory websites

• Monetize through lead generation

• Operate a portfolio of sites for SEO/ranking purposes

• Established circa 2008-2010

Sister company: SEOtool B.V. (technical infrastructure)

Business registration: KVK 51818175, VAT NL001298904B86

Phone: +31 35-5448944

Email: info@imezo.nl

In other words: a legitimate marketing company that registered an abandoned government domain and repurposed it for their standard business model. They didn't break any laws — they simply filled a vacuum created by government neglect.

---

Why the Program Failed

The EPD (Elektronisch Patiëntendossier) was an early attempt at Dutch healthcare IT infrastructure. It had the right goals: streamline medical data sharing and give patients control over their own records.

But it failed spectacularly.

November 8, 2011 — Just one year after the letter was sent — Nictiz announced the program was shutting down.

Reason: Lack of funding and insufficient adoption by general practitioners, hospitals, and pharmacies.

The healthcare sector didn't want it. The government couldn't fund it alone. The initiative collapsed.

---

The Service Continuity Disaster

When a government program shuts down, what happens to the people who engaged with it? What about G.J. de Graaf, who filed an objection and received official confirmation?

Answer: Nothing. Complete silence.

What Should Have Happened

1. Maintain the domain — Keep infoepd.nl pointing to an official "Service Discontinued" page with:

   • Reason for discontinuation

   • Effective date

   • Explanation that registered objections remain in effect

   • Contact information for questions

2. Redirect the phone number — Keep it active or forward calls to Ministry main switchboard

3. Archive the information — Publish historical records so citizens can verify their past interactions

4. Use a protected TLD — Switch to .overheid.nl domain before shutting down, ensuring government maintains permanent control

What Actually Happened

• Domain allowed to expire

• No forwarding or redirects set up

• Phone number disconnected

• Email address abandoned

• No communication to citizens

• Commercial entity registered the domain 9 years later

• Citizens left completely in the dark about their opt-out status

Result: If G.J. de Graaf wanted to verify their objection was registered, they'd hit a dead phone line and end up on a travel/shopping link directory.

---

The Architecture Problem

This wasn't malice — it was institutional failure. Here's what went wrong:

1. Wrong Infrastructure Choice

Generic .nl domains are perfect for commerce and personal projects. They're inappropriate for government services with legal implications.

Solution: Use .overheid.nl for all critical government services. It's protected, permanent, and signals authenticity to citizens.

2. No Sunset Plan

When the program was discontinued in 2011, nobody documented what should happen to the domain, the phone number, the citizen records, or the contact information.

Solution: All government services should have explicit lifecycle plans: launch, operation, sunset, and archive phases.

3. No Service Continuity Strategy

A dead phone line and abandoned email is not a service discontinuation — it's a service collapse. Citizens have no way to:

• Verify their past objections

• Get closure on their case

• Contact anyone for help

Solution: Maintain at least a read-only information page with historical data accessible indefinitely.

4. No Domain Monitoring

The government never registered backup domains or set expiration alerts. A simple .overheid.nl registration would have prevented this.

Solution: Government should monitor all official domains and ensure renewals 12+ months before expiration.

---

Lessons for Government IT

For Government Agencies

1. Use protected TLDs — .gov, .gouv, .gob, .overheid — depending on your country

2. Publish a sunset plan — When services end, tell citizens where their data went and how to contact you

3. Maintain archives — Keep at least a static record accessible indefinitely

4. Monitor domain expiration — Set alerts years in advance

5. Redirect services — Don't just shut them off; redirect to alternative contact methods

For Citizens

1. Screenshot important government communications — Don't rely on websites staying online

2. Save confirmation numbers and reference IDs — If a website goes down, you'll need these for phone support

3. Use official TLDs as a trust signal — Agencies using .gov, .gouv, or .overheid show they're serious about permanence

4. Assume services will eventually disappear — Government agencies change, budgets get cut, priorities shift. Plan accordingly.

---

The Bigger Picture

This isn't unique to the Dutch EPD. It's symptomatic of how governments treat digital infrastructure:

• Short-term funding — Programs get launched with temporary budget

• No long-term planning — What happens when funding ends?

• Lack of institutional memory — New administrations don't inherit project documentation

• Generic infrastructure choices — Using the same domain strategy as a pizza restaurant

When a government service ends, citizens deserve:

• Clear communication about why it's ending

• A way to verify past interactions

• Contact information for questions

• Archived records they can access later

---

Verification

The findings in this article are based on:

1. Original government letter — December 16, 2010, Ministry of Public Health, Welfare and Sport

2. SIDN WHOIS Registry — Official .nl domain registry (sidn.nl)

3. Live domain inspection — Current infoepd.nl website content

4. Historical research — Nictiz program discontinuation announcement (November 8, 2011)

5. Company research — IMEZO registration details, KVK registry

6. User verification — Phone number confirmation (July 2026)

All sources are available upon request.

---

Questions for the Ministry

If the Ministry of Public Health, Welfare and Sport is reading this:

1. What happened to the citizen records from the EPD program?

2. Are objections filed before November 2011 still in effect?

3. How can citizens verify their past opt-outs?

4. Why was no sunset communication sent to citizens?

5. Why wasn't a protected TLD used for this critical service?

6. Do other ministry services have similar domain vulnerability?

---

Know of similar cases? Government services that disappeared from the internet? I'm collecting examples. Get in touch.

---

Last updated: July 2026