Netherlands Cyber Watch
Reports since 1 Jan 2026. Not a live feed.
Threat level, Netherlands
Background readingHacktivismIncident response
No public level found
No published national cyber threat level found for The Netherlands, checked 7 Nov 2026. The Netherlands publishes no national cyber threat level; NCTV's threat level covers terrorism, and NCSC signals cyber threat through advisories and the annual Cybersecuritybeeld Nederland.
Source: NCTV
From official agencies
| Date | Agency | Advisory or alert |
|---|
Agency headlines, unedited.
Compare countries
| Country | Threat level | Confirmed | Claimed only | Via a vendor | Latest report |
|---|---|---|---|---|---|
 Malaysia | Medium | 19 | 35 | 7 | 7 Nov 2026 |
 Singapore | None published | 12 | 24 | 3 | 7 Nov 2026 |
 Indonesia | None published | 6 | 32 | 0 | 5 Nov 2026 |
 Thailand | None published | 9 | 33 | 0 | 3 Nov 2026 |
 Philippines | None published | 9 | 35 | 4 | 7 Nov 2026 |
 Vietnam | None published | 5 | 34 | 0 | 5 Nov 2026 |
 Israel | None published | 4 | 2 | 0 | 7 Nov 2026 |
 Iran | None published | 4 | 0 | 0 | 13 Jun 2026 |
 United Arab Emirates | None published | 4 | 4 | 1 | 7 Oct 2026 |
 Saudi Arabia | None published | 2 | 5 | 0 | 12 Oct 2026 |
 Egypt | None published | 1 | 4 | 1 | 29 Oct 2026 |
 South Africa | None published | 8 | 0 | 1 | 26 Oct 2026 |
 Nigeria | None published | 2 | 3 | 0 | 8 Aug 2026 |
 Kenya | None published | 1 | 6 | 0 | 25 Jul 2026 |
 India | None published | 9 | 2 | 1 | 28 Oct 2026 |
 Pakistan | None published | 3 | 3 | 0 | 22 Jul 2026 |
 Bangladesh | None published | 1 | 5 | 0 | 23 Oct 2026 |
 Sri Lanka | None published | 4 | 3 | 1 | 1 Jul 2026 |
 Cambodia | None published | 0 | 3 | 0 | 10 Jun 2026 |
 Myanmar | None published | 1 | 5 | 0 | 25 Oct 2026 |
 Brunei | None published | 0 | 0 | 0 | |
 Poland | BRAVO-CRP | 5 | 0 | 4 | 1 Oct 2026 |
 Ukraine | None published | 7 | 0 | 1 | 4 Nov 2026 |
 Russia | None published | 7 | 0 | 1 | 1 Nov 2026 |
 Czechia | None published | 3 | 0 | 1 | 22 Oct 2026 |
 Romania | None published | 2 | 0 | 0 | 14 Jul 2026 |
 Estonia | None published | 5 | 0 | 3 | 4 Nov 2026 |
 Turkey | None published | 3 | 0 | 1 | 16 Sep 2026 |
 United Kingdom | None published | 5 | 1 | 3 | 2 Nov 2026 |
 Germany | None published | 4 | 0 | 1 | 2 Nov 2026 |
 France | None published | 7 | 0 | 2 | 4 Nov 2026 |
| Netherlands | None published | 5 | 1 | 1 | 2 Nov 2026 |
 Italy | None published | 5 | 0 | 0 | 7 Nov 2026 |
 Spain | None published | 3 | 0 | 0 | 5 Feb 2026 |
 Ireland | None published | 3 | 4 | 0 | 2 Nov 2026 |
 Sweden | None published | 5 | 3 | 2 | 2 Nov 2026 |
 United States | None published | 6 | 0 | 2 | 28 Aug 2026 |
 Canada | None published | 5 | 0 | 1 | 21 Aug 2026 |
 Mexico | None published | 2 | 4 | 1 | 21 Aug 2026 |
 Brazil | None published | 2 | 2 | 0 | 2 Nov 2026 |
 Argentina | None published | 1 | 2 | 0 | 4 Aug 2026 |
 Chile | None published | 1 | 2 | 0 | 2 Nov 2026 |
 Colombia | None published | 1 | 2 | 0 | 4 Nov 2026 |
 Japan | None published | 9 | 0 | 5 | 4 Nov 2026 |
 South Korea | Caution | 6 | 0 | 2 | 29 Oct 2026 |
 China | None published | 0 | 3 | 0 | 7 Aug 2026 |
 Taiwan | None published | 9 | 0 | 2 | 3 Nov 2026 |
 Hong Kong | None published | 3 | 0 | 3 | 30 Oct 2026 |
 Australia | None published | 5 | 0 | 1 | 2 Nov 2026 |
 New Zealand | None published | 7 | 2 | 1 | 3 Sep 2026 |
2026 counts. Click a row to open a country.
Official numbers
| Measure | Value | Period | Source |
|---|---|---|---|
| Odido customers affected | 6.2 million | February 2026 breach | BleepingComputer |
| Dutch businesses hit in fridge attack | 17 | 2 November 2026 | NL Times |
Who is targeting it
| Group | Kind | What it did | Sources | Reports |
|---|---|---|---|---|
| ShinyHunters | Extortion | Breached Odido and leaked 6.5 million customer records in March 2026. | NL Times | Profile |
| The Gentlemen | Ransomware | Thialf was the group's eighth Dutch victim, according to RTL Nieuws. | NL Times | Profile |
| Clop | Extortion | Published data it says was taken from Shell and Philips in October 2026. | NL Times |
Laws and rules this year
- 11 Sep 2026EU Cyber Resilience Act reporting obligations apply. Manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents from this date; the main obligations follow on 11 December 2027. Source
- 15 Aug 2026Cyberbeveiligingswet (NIS2) enters into force. The Dutch NIS2 law sets security and incident reporting duties for essential and important entities. Source
Full stories
- European supermarket fridges hacked in a single night Estonia, United Kingdom, Germany +5 · 3 Nov 2026
Official statements
Incidents
6 of 6 incidents
| What happened | Sources | |||||
|---|---|---|---|---|---|---|
| ✅ Confirmed17 Dutch food businessesVia a vendorFull story | 2 Nov 2026 | Retail | Not disclosed | None | Confirmed. Danfoss confirmed to NOS that refrigeration systems at 17 Dutch businesses, mainly butchers and small grocers, were attacked. | NL Times✓ 7 Nov |
 ✅ ConfirmedBitonic | 27 Oct 2026 | Finance | Intrusion | None | Confirmed. Bitonic said an attacker exploited a vulnerability, changed login data and took bitcoin from three customer accounts, which it reimbursed. | NL Times✓ 7 Nov |
 ✅ ConfirmedAlbert Heijn (Ahold Delhaize) | 11 Oct 2026 | Retail | Intrusion | None | Confirmed. Ahold Delhaize called the outage of Albert Heijn, Etos and Gall & Gall websites, apps and deliveries a cybersecurity incident; deliveries restarted nearly two weeks later. | NOS · NL Times✓ 7 Nov |
| ⚠️ ClaimedShell and Philips | 8 Oct 2026 | Energy | Data leak | Claimed. Clop published 89 GB it says came from Shell and Philips, including engineering drawings; neither company confirmed. | NL Times✓ 7 Nov | |
 ✅ ConfirmedThialf ice stadium | 24 Jul 2026 | Other | Ransomware | Confirmed. Thialf confirmed to RTL Nieuws that it was hit by a cyberattack and was in talks with the criminals. Claimed. RTL Nieuws attributed the attack to The Gentlemen, which claims internal documents and staff data. | NL Times✓ 7 Nov | |
 ✅ ConfirmedOdido | 12 Feb 2026 | Telecom | Data leak | Confirmed. Odido said a cyberattack on its customer contact system exposed data of 6.2 million customers and reported it to the Dutch Data Protection Authority. Claimed. ShinyHunters claimed the breach and published the data after Odido refused to pay. | BleepingComputer · NL Times✓ 7 Nov |
FAQ
Does Netherlands have a national cyber threat level?
No published national cyber threat level was found for The Netherlands (checked 7 Nov 2026). The Netherlands publishes no national cyber threat level; NCTV's threat level covers terrorism, and NCSC signals cyber threat through advisories and the annual Cybersecuritybeeld Nederland.
Which organisations in Netherlands confirmed cyber incidents recently?
5 incidents confirmed since January 2026: 17 Dutch food businesses, Bitonic, Albert Heijn (Ahold Delhaize), Thialf ice stadium and Odido.
Which Netherlands organisations appear on ransomware or leak sites?
1 claim, not confirmed by the organisations: Shell and Philips.
What counts as a confirmed incident?
The organisation, a regulator, the police or a minister has said something happened, as reported by a named outlet. Everything else is listed as claimed.
Why list leak-site claims at all?
Ransomware and extortion crews post victims on leak sites before anyone confirms. The list shows what attackers say. Treat it as a lead and check with the organisation.
Is the map a live attack feed?
No. It counts incidents and claims reported in 2026. Live attack maps from security vendors show scanning traffic hitting their sensors, which does not mean a place was attacked.
How often is it updated?
By hand when a national level changes or a notable incident is reported. The date is shown in the header.
Sources: official statements and regional press, including Bernama, The Star, Malay Mail, CNN Indonesia and Newsbytes.PH; leak-site claims from public ransomware trackers. Each entry links its source.