Netherlands

This page covers cyber threats to the Netherlands. It brings together official Dutch texts (the General Intelligence and Security Service AIVD, the Defence Intelligence and Security Service MIVD, the National Cyber Security Centre NCSC-NL, the National Coordinator for Security and Counterterrorism NCTV, the Ministry of Justice and Security, the Health and Youth Care Inspectorate and the Tweede Kamer), a US-led advisory, MITRE ATT&CK and Brandefense research. Where an official source names the Netherlands as a target, the page says who said it and when.

Threat groups that official sources link to the Netherlands

Each group below has a profile in our threat group library. Attribution is stated as given by the named body.

APT28: the joint advisory AA25-141A, published by US agencies with partners including the Dutch MIVD (page last revised 17 April 2026), lists the Netherlands among the countries with targeted entities in a campaign against Western logistics and technology companies. The advisory names the Russian military intelligence unit GRU 85th GTsSS, unit 26165, as the actor and says it is commonly known as APT28. The AIVD and MIVD said on 27 May 2025 that the MIVD attributes APT28 to unit 26165, and that a second Russian actor they named LAUNDRY BEAR, behind the Dutch police attack, is distinct from APT28.

Salt Typhoon: the AIVD and MIVD said on 28 August 2025 that the Netherlands was also a target of the Salt Typhoon cyber espionage campaign, which the US attributed to a state-backed Chinese hacking organization. The Dutch targets were smaller internet service and hosting providers, not large telecom providers. The services say the group had access to routers of those targets and, as far as is known, got no further into their internal networks.

Two other actors appear in Dutch official texts without a profile in our library. The MIVD attributed the COATHANGER malware campaign to a Chinese state actor on 6 February 2024 without naming a group. The AIVD and MIVD named LAUNDRY BEAR on 27 May 2025 as a Russian state-supported actor and said it is highly probable that other Dutch organizations were also its victims.

Incidents on record

The incidents listed below are the major ones that Dutch authorities or the organizations themselves reported, with national impact. Where sources differ, the incident page says so. Small incidents are not listed.

How attackers target the Netherlands: Brandefense research

Our own research mentions the Netherlands in a few places. In summary, as our posts report:

State-linked groups: the Mythic Leopard profile and the Ocean Lotus (APT32) profile both list the Netherlands among countries those groups targeted.

Hacktivism and DDoS: our June to July 2023 Anonymous Sudan review lists the Netherlands among the countries the group reached, across sectors from financial services to government.

Exploited edge devices: our NetScaler zero-day analysis says the Netherlands NCSC had already issued a pre-disclosure warning to Dutch organizations, reporting confirmed exploitation at multiple Citrix customers worldwide.

Regulation and policing: our NIS2 and DORA post says supervisors across Germany, the Netherlands and France have signaled that persistent register deficiencies are an enforcement priority. Our ransomware monitoring post notes that the No More Ransom project was created with the Dutch police National High-Tech Crime Unit and Europol. We also have a page on the Dutch Ministry of Finance breach.

How Brandefense helps

In plain words, Cyber Threat Intelligence is how a security team learns which groups and malware are aimed at its country and sector. Dark Web Monitoring is how it learns that staff or customer logins are for sale, and Phishing Monitoring is how it finds fake sites that copy its brand. The Dutch cases above show why: the AIVD and MIVD say LAUNDRY BEAR uses phishing and logins or cookies bought on criminal marketplaces, and the Dutch government names phishing and identity fraud as the main risk after the screening lab leak.

Law and national strategy

The Eerste Kamer approved the Cyberbeveiligingswet (Cbw) on 7 July 2026, and the NCSC says it entered into force on 15 August 2026. It implements the EU NIS2 directive and replaces the Wet beveiliging netwerk- en informatiesystemen (Wbni). It covers organizations in 18 sectors, including energy, drinking water, digital infrastructure, healthcare, government and transport, and the government says new obligations apply to more than 8,000 organizations. Covered organizations must register in the entity register through the NCSC, take risk measures and report significant incidents. The board is ultimately responsible for cyber risk management. A second law, the Wet weerbaarheid kritieke entiteiten, implements the EU CER directive on critical entities. The sources opened give no separate national strategy text.

How incident response is organized

The NCSC-NL says it works to strengthen the digital resilience of 2.4 million businesses and organizations, and serious incidents are reported to it. Under the Cbw, significant incidents must be reported as soon as possible, and within 24 hours, to the CSIRT and the supervisor. The AIVD and MIVD publish cyber advisories from their own intelligence work and, as in the police case, can tell a victim that it was attacked. The Public Prosecution Service started a criminal investigation into the police breach, carried out by Team High Tech Crime of the police; the Ministry of Finance also contacted that team. The Dutch Data Protection Authority receives data breach reports, and the Health and Youth Care Inspectorate investigated the screening lab breach. The NCTV publishes the yearly Cybersecuritybeeld Nederland.

Sectors and resilience

The NCTV report Cybersecuritybeeld Nederland 2025 says the cybersecurity measures of many central government organizations have been inadequate for a long time. It reports at least 121 unique ransomware incidents in the Netherlands in 2024, and that in 2024 the Data Protection Authority received 1,430 unique data breach notifications of cyberattacks, of which it investigated 853. The CBS cyber security monitor, as summarized by the NCSC on 28 May 2026, shows the share of companies hit by a cyberattack fell to its lowest level in nine years. In 2025, 86 percent of large companies took ten or more of the twelve measures asked about, against 13 percent of micro companies. On 24 June 2025 the NCSC said Dutch organizations linked to the NATO summit, including municipalities, were hit by DDoS attacks claimed by NoName057(16), with limited impact.

The official sources opened give some counts for 2024 but no single total number of attacks on the Netherlands. Figures for the Netherlands will come from Brandefense Atlas.