It was a matter of when, not if...
24 Sep 2026 - DIVD
Security people always say it’s not a matter of if, but when you get hacked. It took us (almost) seven years but we can now say that we’re the hackers that got hacked. We noticed suspicious activity, investigated, and came to the inevitable conclusion that damn, we got hacked.
So what do hackers do when they get hacked? Handle it the way we think it should be handled. That is open, transparent and honest, even if it sucks. So far, we’ve been in full incident response mode, blocked access to our infrastructure and started a forensics investigation with the assistance of a third party incident response team.
This is an attack we have not seen before. Not because it’s our first, but because the modus operandi indicates that this is an agentic AI powered attack. Careful investigation takes time and our investigation is still ongoing. At this moment we can’t rule anything out yet, so we handle this situation as a worst-case-scenario and assume breach until proven otherwise.
Today we have informed the directly involved parties, reported the incident to the Autoriteit Persoonsgegevens and the National Cyber Security Centre and discussed our options with the police.
Our priorities at this point are keeping our infrastructure isolated and secure, focusing on the forensics and looking after our volunteers who have worked for a safe digital society for the past years and in the meantime we learn a lot from this type of attack.
Our next public update follows on Monday 28 September, or sooner if we have more to share.
For questions and press please reach out to Marieke Rijken via communications@divd.nl. She is the spokeperson for this incident.
Last modified: 24 Sep 2026 23:34 CEST