Loading story…
CBS and the Dutch National Cyber Security Centre (NCSC) report that cyber incidents affecting Dutch businesses have declined, but microbusinesses, self-employed workers, and other SMEs remain materially less protected than large enterprises. In the 2025 monitor, 86% of large companies had implemented at least 10 of 12 assessed security measures, compared with 13% of microbusinesses; companies reporting at least one external cyber incident fell to 4% in 2024. Phishing and spoofing remained the most commonly reported incident types, affecting 23% of businesses.
The disparity extends to foundational controls: only 29% of surveyed SMEs conduct risk assessments, 9% mandate security training, 37% encrypt data, 61% use multifactor authentication, and 66% keep backups at a separate physical location. The trend follows prior monitors showing increased adoption of 2FA—from 26% of businesses in 2017 to 61% in 2024—and fewer ransomware and other ICT-security incidents, while large organizations continue to report more incidents due partly to more complex environments and stronger detection. NCSC urged SMEs to adopt its five digital-security basics and CyberVeilig Check, noting that participation in security collaboration networks correlates with stronger safeguards.
See the reporting duties and controls this puts on the clock.
10 events from the most recent confirmed update back to the earliest known activity.
In 2025, 86% of Dutch companies with at least 250 employees had implemented at least 10 of 12 surveyed cybersecurity measures, compared with 13% of microbusinesses. MFA adoption reached 97% among large companies, while only 33% of microbusinesses used data encryption.
In 2024, 16% of large Dutch companies reported at least one externally caused cyber incident, unchanged from 2023. Across all companies, the proportion reporting at least one external incident was 4%, while 23% reported phishing or spoofing.
In 2023, 1% of Dutch companies with at least two employees reported ransomware; 2% of affected firms paid ransom. Twenty percent of firms reporting either internal or external cybersecurity incidents incurred costs, down from the 2016 levels.
The share of the largest Dutch companies reporting an externally caused ICT security incident fell to 18% in 2022. Ransomware-affected companies with at least two employees engaged a cybersecurity firm in 37% of cases and reported the incident to police in 18% of cases.
Dutch businesses reported 6,300 ransomware attacks in 2021, including 4,000 involving self-employed workers. Eleven percent of affected companies with at least two employees paid ransom.
The total number of internally and externally caused ICT security incidents began a downward trend across all Dutch company sizes in 2020.
Dutch companies' use of secure login methods rose from 26% in 2017; among companies with 10 to 50 employees, MFA use was 29%.
Nearly 40% of Dutch companies with 250 or more employees reported an externally caused cybersecurity incident in 2016.
NCSC presented CBS findings that only 29% of surveyed Dutch SMEs performed a risk analysis, 9% required ICT-security training, and 37% used data encryption. The findings also showed 61% used MFA and 66% retained backups at a separate physical location.
The Digital Trust Center became part of the Dutch National Cyber Security Centre on 1 January 2026.
See what this changes for your reporting obligations and which controls it puts on the clock.
6 references tracked. Mallory keeps watching after this page renders.
ncsc.nl
Open sourcencsc.nl
Open sourcencsc.nl
Open sourcencsc.nl
Open sourcecbs.nl
Open sourcencsc.nl
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Small and medium-sized businesses (SMBs) are increasingly targeted by cybercriminals due to their typically limited security resources and lack of mature controls. Attackers exploit the ability to scale low-effort techniques, such as phishing and credential-stuffing, across thousands of similar SMB environments. Recent data highlights that SMBs are targeted nearly four times more than large organizations, with reported cybercrime losses reaching $16.6 billion in 2024. Business email compromise (BEC) and phishing remain the most costly threats, and basic security hygiene—such as strong identity management, multi-factor authentication (MFA), and regular validation—are critical for reducing risk. Adopting a strategic, risk-based approach to cybersecurity is essential for SMBs. The CISSP (Certified Information Systems Security Professional) mindset emphasizes identifying key digital assets, conducting lightweight risk assessments, and prioritizing controls that offer the most protection with minimal complexity. Security decisions should be directly linked to business objectives, and even organizations with small IT teams can implement enterprise-level strategies like layered defenses, zero trust principles, and clear security ownership. By focusing on business-driven security and right-sized defense-in-depth, SMBs can transform cybersecurity from a technical hurdle into a business enabler.
Jul 12, 2026
The UK government advanced its **Cyber Security and Resilience Bill** after publishing policy materials in 2024 and formally introducing the legislation to Parliament in November 2025, later adding an impact assessment, factsheets, supporting research, and notice that the Regulatory Policy Committee rated the assessment **fit for purpose**. The bill is part of a broader push to strengthen cyber resilience obligations as the government also signaled tougher online safety enforcement and wider expectations that critical services and digital platforms improve security governance. Government survey data published in 2026 showed why the pressure is increasing: **43% of UK businesses** and **28% of charities** reported a cyber breach or attack in the previous year, with **phishing** remaining the most common and disruptive threat. While ransomware among businesses fell to **1%**, the survey found repeat victimisation drove an estimated **5.19 million** cyber crimes against UK businesses, and more advanced controls such as **two-factor authentication**, formal incident response plans, VPN use, and supplier risk reviews remained uneven, especially among smaller organisations. Industry reporting said the findings are sharpening focus on resilience measures including **Cyber Essentials Plus**, phishing-resistant MFA, network segmentation, tested backups, dependency mapping, and board-level reporting on recovery and operational survivability.
Sep 2, 2026
UK reporting highlighted persistent weaknesses in baseline cyber hygiene and a growing expectation that **phishing and social engineering** will succeed against many organizations. A Vodafone Business-commissioned snapshot cited by Tech Radar/SC Media reported that **63% of UK businesses** feel more exposed to cyberattacks than a year ago, **71% of leaders** think employees are vulnerable to phishing, and staff reuse work passwords across an average of **11 personal accounts**; only **45%** of organizations said all staff had completed basic cyber awareness training. The same coverage noted increasing concern about **AI-enabled scams and deepfakes**, with **70%** reporting greater suspicion of video calls impersonating senior leaders, and pointed to the UK government’s planned *Telecommunications Fraud Charter* as part of broader anti-fraud efforts. Separately, the Bank of England’s 2025 CBEST review (summarized by The Register) found that regulated financial firms and **financial market infrastructures (FMIs)** still commonly fail on fundamentals observed during **13 CBEST assessments and regulator-backed penetration tests**, including **weak access controls**, poor password practices, **misconfigured and inconsistently patched systems**, and gaps in **intrusion detection** and vulnerability management. The report emphasized that firms should be prepared to **handle breaches** rather than relying only on preventive controls, and that weak security culture enables attackers to bypass controls via social engineering; it also warned that inadequate helpdesk identity-verification processes can enable fraudulent credential access, with the NCSC noting such tradecraft aligns with groups like **Scattered Spider**.
Jul 12, 2026