we have been hit by ransomware is that automatically a data breach

Ransomware is usually a personal data breach, but not automatically

A ransomware attack is usually a personal data breach under the GDPR, but the link between "hit by ransomware" and "therefore notify" is not automatic. Article 4 of the GDPR defines a breach as any destruction, loss, alteration or unauthorised disclosure of personal data. With ransomware, files are encrypted or made inaccessible, and that falls under "loss of availability" — even if the data has not been viewed or copied. This usually meets the definition of a breach, which is incidentally something different from the question what exactly is a data breach means for the notification obligation in a specific case.

Whether personal data was in those encrypted files, and whether there is actually risk for the people whose data is involved, remains a separate question. A ransomware attack on a server without personal data is not a breach under the GDPR. An attack where data is affected, but there is a working backup and quick recovery is possible, may pose lower risk than an attack where data has also been exfiltrated (double extortion). That risk assessment then determines when a personal data breach must be reported to the Dutch Data Protection Authority, and whether those affected must themselves be told.

Where this is based on

The definition of a breach in Article 4 of the GDPR is the starting point; Article 33 of the GDPR governs notification to the supervisory authority once a breach occurs, and Article 32 of the GDPR addresses the question of whether security was in order before the attack took place. The EDPB guidelines explicitly work through examples with ransomware, including the distinction between encryption without exfiltration and attacks where data has also been stolen. The obligation to assess a breach and, if necessary, notify is the same throughout the EU, because the GDPR applies directly; which supervisory authority receives the notification varies by Member State — in the Netherlands it is the Dutch Data Protection Authority, in other countries the supervisory authority of that Member State. When an IT provider or hosting partner is hit by ransomware, there is also the question whether a notification from a provider also triggers its own notification obligation.