diff --git a/content/newsroom/articles/case-leaked-phishing-credentials-zoom.en.md b/content/newsroom/articles/case-leaked-phishing-credentials-zoom.en.md
new file mode 100644
index 00000000..c080dded
--- /dev/null
+++ b/content/newsroom/articles/case-leaked-phishing-credentials-zoom.en.md
@@ -0,0 +1,38 @@
+---
+title: "CASE: LEAKED PHISHING CREDENTIALS (ZOOM)"
+date: 2021-07-01T00:01:00+02:00
+author: []
+tag: case
+intro: At the end of November 2020, criminals engaged in a phishing campaign mimicking Zoom message invites and a message on mail quarantine. On 01-01-2021 email notifications were sent to the victims of the phishing campaign. A total of 370 emails were sent.
+image: ""
+Alt tag for image: ""
+case:
+  caseid: DIVD-2020-00013
+  closed: true
+  link: https://csirt.divd.nl/cases/DIVD-2020-00013/
+  lead: Frank Breedijk
+  leadlink: https://www.divd.nl/who-we-are/team/people/frank-breedijk/
+  researchers:
+    - label: Bauke Gehem (external)
+      link: ""
+  researchers_people: []
+faq_enabled: false
+faq: null
+---
+Written on **01 Jul 2021** by Joris van de Vis, updated on **09 Dec 2024** by [Serena de Pater](https://www.divd.nl/who-we-are/team/people/serena-de-pater/)
+
+## The case
+
+At the end of November 2020, criminals engaged in a phishing campaign mimicking Zoom message invites and a message on mail quarantine. This campaign was reported on Twitter by TheAnalyst.
+
+## The impact
+
+While researching this phishing campaign, Bauke Gehem of Summa College, discovered that the phishing infrastructure used by the criminals was not properly secured and leaked the captured usernames and passwords because of unsecured directories. From a partner CERT, DIVD CSIRT has been given the Dutch part of the harvested credentials to inform potential victims.
+
+## What we did
+
+After an internal discussion we came to the conclusion that victims of the attack should be informed. We started processing the data internally to prepare for informing the victims and to give them some additional advice on how to proceed. Since we received the Dutch part of the data it was decided to write the emails in Dutch and English.
+
+On 1-1-2021 email notifications were sent to the victims of the phishing campaign. A total of 370 emails were sent.
+
+As there was no new information and the victims were informed, the case was closed after the emails were sent. Involved researchers deleted their local data, with only report writing waiting to be done. This was done in June 2021.
diff --git a/content/newsroom/articles/case-leaked-phishing-credentials-zoom.nl.md b/content/newsroom/articles/case-leaked-phishing-credentials-zoom.nl.md
new file mode 100644
index 00000000..b0021b35
--- /dev/null
+++ b/content/newsroom/articles/case-leaked-phishing-credentials-zoom.nl.md
@@ -0,0 +1,13 @@
+---
+title: xx
+date: ""
+author: []
+tag: ""
+intro: xx
+image: ""
+Alt tag for image: ""
+case: null
+faq_enabled: false
+faq: null
+---
+xx