Loading story…
A Dutch broadcaster demonstrated an operational security failure by tracking the air-defense frigate HNLMS Evertsen after hiding a low-cost Bluetooth tracker inside a postcard mailed to the ship. Using publicly available Dutch Ministry of Defence mailing instructions for deployed personnel, the journalists sent the device to the vessel, where it reportedly remained active for about 24 hours and revealed movement from Heraklion, Crete, toward Cyprus.
Dutch defence officials said the tracker was discovered during mail sorting and disabled, but the incident exposed weaknesses in mail-screening procedures and the risks posed by consumer tracking technology combined with routine administrative information. The Ministry of Defence said it is changing its mail policies, including banning greeting cards containing batteries and reviewing broader guidance for mail sent to deployed forces; the frigate was reportedly operating on a mission to protect the French aircraft carrier Charles de Gaulle.
See the actors and campaigns active against you right now.
4 events from the most recent confirmed update back to the earliest known activity.
In response to the tracking incident, the Dutch Ministry of Defence said it changed or began reviewing its mail policies. Measures included banning greeting cards containing batteries and reassessing broader mail guidance for deployed personnel.
Dutch defence officials said the hidden tracker was discovered by the crew during mail sorting and then disabled. The discovery ended the live location exposure but highlighted weaknesses in screening mailed items sent to deployed forces.
After reaching the ship, the Bluetooth tracker reportedly remained active for roughly 24 hours, allowing the journalists to follow HNLMS Evertsen's movement from Heraklion, Crete, toward Cyprus. The incident demonstrated that a consumer tracking device could reveal operational movements of a naval vessel.
Dutch broadcaster Omroep Gelderland used publicly available Dutch Ministry of Defence mailing instructions to send a Bluetooth tracker hidden inside a postcard to the deployed frigate HNLMS Evertsen. The tracker was intended to test whether the ship's location could be exposed through ordinary mail.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
5 references tracked. Mallory keeps watching after this page renders.
schneier.com
Open sourcedatabreaches.net
Open sourcetomshardware.com
Open sourcescworld.com
Open sourcego.theregister.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Chinese-made camera components installed on Royal Navy K3 Scout surveillance drones were found to be transmitting data to China, prompting the UK Ministry of Defence to cut the cameras' internet connectivity after discovering the issue during a routine cyber vulnerability assessment. The affected uncrewed vessels, reportedly sourced through Kraken Technology Group from a third-party supplier that had provided security assurances, were used in Portsmouth Harbour and had been linked in reporting to operations involving Britain's special forces and planned Gulf missions. The Ministry of Defence said it found no evidence that MoD data or systems were accessed, compromised, or transmitted externally, and stated that the traffic consisted only of non-sensitive "heartbeat communications" rather than operational imagery or classified information. The disclosure has nevertheless intensified scrutiny of Chinese technology embedded in Western defence platforms, particularly surveillance and drone systems used in sensitive military environments.
Aug 10, 2026
French authorities are investigating a suspected cyberattack targeting the GNV ferry Fantastic, which operates between Sète and North Africa. The investigation was initiated after Italian intelligence, acting on information from GNV, alerted French officials about two sailors—one Latvian and one Bulgarian—suspected of espionage for a foreign power. During a search of the vessel in the port of Sète, French intelligence agents detained the two individuals and discovered a device containing RAT-type malware capable of remotely controlling the ship's navigation systems. The Latvian sailor was charged in Paris with conspiracy to serve a foreign power, attempted computer system intrusion, and possession of devices intended to interfere with navigation, while the Bulgarian was released. GNV reported that it had identified and neutralized the attempted intrusion, stating that its systems remained protected and unaffected. The company has fully cooperated with authorities throughout the investigation, which is reportedly focusing on possible Russian involvement amid broader concerns about hybrid warfare in European waters. The vessel was temporarily sealed for safety checks but has since resumed operations. Italian police and Eurojust have also conducted searches in Latvia as part of the ongoing inquiry into whether the ship's systems were exposed to malware designed for remote hijacking.
Jun 29, 2026
Dutch intelligence agencies **AIVD** and **MIVD** warned that Russian state-backed hackers are systematically compromising internet-connected **IP cameras** in the Netherlands, elsewhere in Europe, and Ukraine to support military espionage. The operation targets exposed cameras with **default passwords**, **outdated firmware**, and insecure default settings, then uses the video feeds to monitor **NATO military logistics**, including routes linked to weapons shipments bound for Ukraine. Dutch authorities said a small number of compromised cameras were identified along military logistics routes in the Netherlands, a key transit country for support to Kyiv. The advisory said the campaign extends beyond supply-chain surveillance and, in Ukraine, compromised cameras have in some cases been used to help locate **Ukrainian troops** for attempted battlefield strikes. Investigators said the actors also apply **image-recognition software** to analyze footage for military vehicles and cargo, underscoring a broader Russian effort to collect militarily relevant intelligence inside **NATO** and **EU** countries. The Dutch services described the activity as an ongoing espionage operation and issued security guidance to help organizations secure internet-accessible cameras against further compromise.
Aug 31, 2026