Loading story…
The Dutch government barred New York-based Kyndryl from acquiring Amsterdam cloud provider Solvinity Group after an investment-screening review found the transaction posed a risk to the public interest. Solvinity supports critical Dutch digital services including DigiD and MijnOverheid, and officials said foreign ownership could expose sensitive government identity infrastructure to external control. The decision was announced by Dutch digital economy minister Willemijn Aerdts, who issued a full prohibition on the takeover.
Authorities tied the move to national security, digital autonomy, and protection of critical infrastructure, reflecting wider European concern over reliance on U.S. technology firms and the reach of the U.S. CLOUD Act over data held abroad. The proposed sale had already drawn legal challenges from privacy activists and citizens, and the Dutch government had extended Solvinity’s contract to avoid disruption to DigiD while the review was underway. Kyndryl said it was extremely disappointed and argued the process had become politicized, while Solvinity said it would continue discussions with authorities.
See the reporting duties and controls this puts on the clock.
8 events from the most recent confirmed update back to the earliest known activity.
After the ban was announced, Kyndryl said it was extremely disappointed and argued the review process had been politicized, while Solvinity said it would continue discussions with authorities.
Dutch authorities investigated New York-based Kyndryl's proposed acquisition of Amsterdam-based cloud provider Solvinity because the company supports DigiD and MijnOverheid, raising concerns about national security, digital autonomy, and critical infrastructure.
Before ruling on Kyndryl's proposed acquisition, the Dutch government separately extended Solvinity's contract to avoid operational risk to DigiD and related government services.
In a letter published Monday, Dutch digital economy minister Willemijn Aerdts imposed a complete prohibition on Kyndryl's acquisition of Solvinity, citing risks to the public interest because DigiD-related infrastructure and data could come under foreign control.
Dutch authorities arrested two men, searched business locations and data centers, and seized 800 servers, records, and electronic devices in a sanctions investigation tied to a hosting provider allegedly linked to cyberattacks and disinformation.
A coalition led by Privacy First took legal action against the proposed takeover of Solvinity, arguing that control over a provider tied to DigiD raised serious public-interest and sovereignty concerns. This legal challenge predates the Dutch government's later screening decision and prohibition of the deal.
On 2025-05-20, the European Union placed the hosting company on its sanctions list over alleged links to Russian destabilization activities. Investigators later said parts of its infrastructure were moved to a newly created Dutch front company after the designation.
Dutch investigators said the hosting company at the center of the case was founded on 2022-02-10 and later became involved in cyberattacks, interference operations, and disinformation campaigns targeting the European Union.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
9 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcebankinfosecurity.com
Open sourcetechcrunch.com
Open sourcegovinfosecurity.com
Open sourcehackread.com
Open sourcecybersecuritynews.com
Open sourcehelpnetsecurity.com
Open sourcedigid.nl
Open sourceprivacyfirst.nl
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Dutch government has taken unprecedented action against Nexperia, a semiconductor company owned by China's Wingtech Technology, by placing it under special administrative measures due to serious governance failures. The Ministry of Economic Affairs invoked the Goods Availability Act, citing recent and acute shortcomings that pose a threat to the continuity and safeguarding of crucial technological knowledge and capabilities within the Netherlands and Europe. Officials expressed concern that the loss of these capabilities could jeopardize economic security, particularly the supply of chips essential for automotive and consumer electronics during emergencies. Under these measures, the Minister of Economic Affairs now has the authority to block or reverse any corporate decisions by Nexperia that could harm the company’s interests, its future as a Dutch operation, or the critical supply chain it represents. Reports indicate that the intervention was prompted by fears that Nexperia might transfer sensitive chip technology to its China-based parent company, Wingtech. In response, Wingtech has publicly condemned the Dutch government’s actions, labeling them as politically motivated and driven by geopolitical bias rather than objective security concerns. The measures effectively freeze Nexperia’s global operations for one year, prohibiting changes to assets, intellectual property, operations, or personnel. Wingtech has announced its intention to appeal the decision in court and is seeking support from the Chinese government. This move marks the first time the Dutch government has used its powers under the Goods Availability Act, highlighting the growing scrutiny of Chinese involvement in Europe’s semiconductor sector. The Dutch military intelligence agency, MIVD, has previously warned of intensifying Chinese espionage targeting domestic semiconductor research institutions, particularly companies like ASML that supply advanced lithography machines. The broader context includes increasing Western concerns about the transfer of intellectual property to Chinese entities, both through commercial channels and cyber-enabled espionage. The Dutch government’s intervention underscores the strategic importance of semiconductor manufacturing and the heightened sensitivity around technology transfers amid global geopolitical tensions. Nexperia’s operations, including its previous ownership of Britain’s Newport Wafer Fab, have been under scrutiny as European governments seek to secure their technological infrastructure. The case reflects a wider trend of governments invoking national security to justify intervention in critical technology sectors. The situation remains fluid as legal challenges and diplomatic responses unfold, with potential implications for the global semiconductor supply chain. The Dutch action is seen as a signal to other European countries about the risks of foreign ownership in key technology industries. The outcome of this intervention may set a precedent for future government oversight of technology firms with foreign ties. The incident also highlights the intersection of economic policy, national security, and international relations in the high-stakes semiconductor industry.
Jun 29, 2026
The Dutch government has intensified scrutiny over semiconductor exports and corporate governance involving Chinese-owned firms, notably Nexperia and ASML. China has formally urged the Netherlands to resolve the ongoing dispute over Nexperia, a Dutch chipmaker owned by China’s Wingtech, after Dutch authorities placed the company under state supervision to prevent technology transfers. This intervention disrupted supply chains for basic electronic components, prompting China to request the restoration of normal operations and to criticize what it calls undue administrative interference. The dispute has led to diplomatic tensions, with China seeking to facilitate negotiations and the Dutch government facing pressure to balance national security with economic interests. Simultaneously, ASML, the sole global supplier of advanced photolithography equipment, faces criticism for selling deep ultraviolet (DUV) lithography machines to Chinese firms with military ties, including those involved in quantum technology development. While ASML maintains that the equipment sold is not subject to current export controls and cannot produce state-of-the-art chips, concerns persist among Western analysts and Dutch authorities about the potential military and strategic implications. These developments highlight the broader struggle between Western governments and China over technology transfer, export controls, and the safeguarding of critical semiconductor supply chains.
Jun 29, 2026
DigiNotar, a Dutch certificate authority, was compromised and used to issue at least 531 fraudulent SSL certificates for 344 domains, including `google.com`, enabling spoofing and man-in-the-middle attacks against supposedly secure services. Reporting indicated the fake Google certificate was likely used to intercept Gmail traffic from users in Iran, potentially exposing roughly 300,000 accounts and putting dissidents at risk. The breach was publicly linked to the actor who had claimed responsibility for the earlier Comodo certificate fraud, and it intensified criticism of the certificate authority trust model as incapable of resisting nation-state abuse. The fallout spread quickly across browsers, operating systems, and government services. Google, Microsoft, and Mozilla moved to distrust DigiNotar certificates, while Microsoft issued advisory `2607712` and updates including `KB2607712` and `KB2616676` to place DigiNotar certificates in the Windows Untrusted Certificate Store; Safari users were reported to remain exposed for a time. In the Netherlands, the government took over DigiNotar’s operations after investigators found severe security failures, warned that it could not guarantee the safety of its own websites, and shifted trust for public-sector certificates as DigiNotar’s business collapsed into bankruptcy.
Jun 29, 2026