Loading story…
The Netherlands integrated the Digital Trust Center (DTC) into the National Cyber Security Centre (NCSC) on 1 January 2026, consolidating the DTC, NCSC and CSIRT-DSP into a national capability for public- and private-sector cyber-threat, victim and target notifications. The organizations had already established a single NCSC intake point for threat and incident data and a common assessment framework, aiming to provide organizations with a scalable warning service from one sender. The Wet bevordering digitale weerbaarheid bedrijven provides the legal basis to process and share vulnerability, threat and incident information—including necessary IP-address and business-contact data—with non-critical businesses.
The DTC’s notification service expanded from targeted alerts launched in 2021 to more than 140,000 company-specific warnings in 2023 and over 238,000 vulnerability warnings during 2024. Notifications covered exposed internet services, configuration errors, vulnerable software and leaked corporate credentials, including alerts connected to Operation Endgame. At Saxion University of Applied Sciences, a DTC alert about stolen email credentials enabled rapid password resets, log reviews and user notification; MFA prevented account misuse and the institution found no resulting damage. The integrated NCSC service will continue delivering actionable alerts and supporting Dutch organizations with NIS2 preparedness guidance, community intelligence sharing and cyber-resilience tools.
See the reporting duties and controls this puts on the clock.
22 events from the most recent confirmed update back to the earliest known activity.
The DTC notified Saxion University of Applied Sciences that stolen Saxion email credentials had been identified in Operation Endgame victim data. Saxion reset affected active accounts, reviewed logs, and found no evidence of misuse or damage; it said MFA prevented credential-based logins.
Hundreds of DTC Community members attended the first in-person Digital Trust Community Event to exchange knowledge on AI, quantum technology, behavioral change, and ransomware.
The Europe-wide Operation Endgame law-enforcement action against botnets used in ransomware attacks resulted in 33 servers being taken offline in Dutch data centers. The operation also exposed Dutch victim data held by criminals.
During 2024, the DTC warned Dutch businesses about more than 238,000 vulnerabilities, a 70% increase in Notification Service warnings over 2023.
The DTC and the Ministry of Economic Affairs and Climate held the webinar “De impact van NIS2 op jouw organisatie” to explain the NIS2 Directive and preparations for forthcoming legislation.
The DTC, NCSC, and CSIRT-DSP began intensive cooperation on target and victim notifications, expanding and automating the delivery of company-specific threat warnings.
The DTC published its Benchmarkonderzoek, examining cybersecurity-control adoption among Dutch self-employed workers and SMEs, including organizations with and without IT service providers.
The DTC notification service sent more than 140,000 company-specific cyber-threat warnings to Dutch businesses during 2023, aided by expanded intelligence sources, automation, and cooperation with NCSC and CSIRT-DSP.
The DTC launched the CyberVeilig Check in 2023, offering self-employed workers and small and medium-sized businesses a practical checklist of baseline cybersecurity measures.
By 15 June 2022, the DTC had proactively notified more than 1,700 Dutch companies of serious company-specific threats or vulnerabilities, including exposed systems, configuration errors, and stolen credentials.
During 2022, the DTC sent more than 6,500 warnings to companies that were victims of, or vulnerable to, cyberattacks. Many warnings involved vulnerabilities in internet-accessible systems.
A DTC pilot matched participant technical data against threat intelligence to issue automated targeted warnings. Its first pilot notification was issued in October 2021.
After receiving OKTT status, the DTC began proactively notifying individual non-critical-sector companies about serious vulnerabilities and other acute cyber threats using intelligence shared by the NCSC.
During 2021, the DTC launched its Community information-sharing environment and introduced active warnings for individual companies facing serious cyber threats.
The Digital Trust Center (DTC) was established within the Dutch Ministry of Economic Affairs and Climate Policy to improve the cyber resilience of non-vital Dutch businesses.
The Digital Trust Center became part of the National Cyber Security Centre following the integration of the DTC, NCSC, and CSIRT-DSP functions.
The Tweede Kamer adopted the proposed Wet bevordering digitale weerbaarheid bedrijven by a large majority, providing a legal basis for warning non-vital businesses about vulnerabilities and security incidents.
The three organizations intensified work on a joint national cyber-threat warning service, using a central NCSC intake point and a uniform assessment framework for company-specific notifications.
The Wet bevordering digitale weerbaarheid bedrijven entered into force, authorizing the Dutch economic minister to process and distribute vulnerability, threat, and incident information to non-vital businesses, including for direct risk notifications.
The DTC's notification-service pilot involved 57 companies; 46 received one or more alerts, totaling more than 2,000 notifications based on approximately one million submitted technical data points.
Following a DTC notification, B.F. Systemen immediately corrected an incorrectly configured LDAP service that was publicly accessible and could have exposed confidential information.
The DTC promoted its closed Community for Dutch businesses and cybersecurity personnel, providing urgent threat intelligence, a knowledge-sharing forum, and access to cybersecurity experts.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
19 references tracked. Mallory keeps watching after this page renders.
digitaltrustcenter.nl
Open sourcencsc.nl
Open sourcencsc.nl
Open sourcencsc.nl
Open sourcencsc.nl
Open sourcencsc.nl
Open sourcencsc.nl
Open sourcencsc.nl
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Netherlands’ **Cybersecurity Act** (`Cyberbeveiligingswet`, Cbw) has taken effect, transposing the EU’s NIS2 Directive and replacing the former Wbni framework. More than 8,000 organizations providing essential or important services across 18 sectors must register in the national entity register, manage network and information-system risks, report significant incidents to their designated CSIRT and competent authority, and establish board-level accountability for cybersecurity, including director training. The National Cyber Security Centre manages the register and can provide registered entities or their sectoral CSIRTs with threat intelligence and incident assistance; supervisory authorities will enforce compliance. The accompanying **Critical Entities Resilience Act** (`Wet weerbaarheid kritieke entiteiten`, Wwke) implements the EU CER Directive and will designate roughly 500 critical entities. Those organizations must address resilience against cyber incidents as well as sabotage, terrorism, natural disasters, and other disruptions to essential services. Although the Cbw does not directly regulate suppliers, covered organizations must manage supply-chain risks and may require risk-proportionate security controls and supporting evidence from direct suppliers whose products or services could affect their systems or physical operations.
Aug 31, 2026
The Dutch House of Representatives approved the **Cybersecurity Act** (`Cyberbeveiligingswet`), advancing the Netherlands’ implementation of the EU `NIS2` Directive. The act will replace the existing Network and Information Systems Security Act (`Wbni`) and impose statutory cybersecurity due-care, incident-reporting, and registration obligations on thousands of essential and important organizations. The National Cyber Security Centre’s remit is expected to expand to more than 8,000 organizations. The bill now proceeds to the Senate, while the government continues preparing the Cybersecurity Decree and sector-specific ministerial rules, including incident-reporting thresholds. The government has sought to align commencement of the act, its implementing measures, and the related Critical Entities Resilience Act—implementing the EU `CER` Directive—with a target effective date in the second quarter of 2026, subject to completion of the legislative process. Organizations likely to fall within scope have been urged to prepare controls, governance, supply-chain safeguards, and reporting processes ahead of enforcement.
Aug 31, 2026
CBS and the Dutch National Cyber Security Centre (NCSC) report that cyber incidents affecting Dutch businesses have declined, but microbusinesses, self-employed workers, and other SMEs remain materially less protected than large enterprises. In the 2025 monitor, 86% of large companies had implemented at least 10 of 12 assessed security measures, compared with 13% of microbusinesses; companies reporting at least one external cyber incident fell to 4% in 2024. Phishing and spoofing remained the most commonly reported incident types, affecting 23% of businesses. The disparity extends to foundational controls: only 29% of surveyed SMEs conduct risk assessments, 9% mandate security training, 37% encrypt data, 61% use multifactor authentication, and 66% keep backups at a separate physical location. The trend follows prior monitors showing increased adoption of 2FA—from 26% of businesses in 2017 to 61% in 2024—and fewer ransomware and other ICT-security incidents, while large organizations continue to report more incidents due partly to more complex environments and stronger detection. NCSC urged SMEs to adopt its five digital-security basics and CyberVeilig Check, noting that participation in security collaboration networks correlates with stronger safeguards.
Aug 31, 2026