NCTV warns AI is now used in every phase of cyberattacks on the Netherlands

AI speeds up attacks

The National Coordinator for Counterterrorism and Security (NCTV) published its annual Cybersecuritybeeld Nederland on Friday, 6 November 2026. For the first time the agency says it has evidence that AI models are used in every phase of a cyberattack. Hackers working for Russia or China use the technology to find weaknesses in systems faster, to have malware written by AI and to rewrite code while an attack is running. Because AI takes over part of the work, attackers need less knowledge and skill, which makes hacking accessible to a wider group. The NCTV describes the speed, scale and efficiency of attacks as all increasing.

The report points to the cloud security company Sysdig, which in the summer of 2026 found ransomware that was fully autonomous and could carry out an attack on a company on its own. The NCTV coordinator, Marc Kuipers, put the urgency in one line:

“Because of AI, the cyber threat is accelerating, and we must act now.”

Russia, China, Iran and North Korea

The NCTV names Russia, China, Iran and North Korea as states with offensive cyber programmes aimed at the Netherlands, and it sees a second threat coming from cybercriminals. Russian groups carry out attacks on European and Dutch targets constantly, seeking intelligence about the war in Ukraine and trying to create unrest among NATO allies. Russian hackers have tried to break into Signal and WhatsApp accounts of Dutch civil servants. The report also says Russia hacked internet-connected cameras belonging to businesses and private individuals, which let it follow military transport routes, including deliveries of equipment to Ukraine.

According to the NCTV, North Korea has thousands of highly educated IT specialists working secretly for Western companies under false identities, using forged papers and CVs during digital job applications. Their salaries flow back to North Korea's nuclear programme or support Russia's war effort. Iran has used malicious software to get into devices and accounts of dissidents and journalists who are critical of the regime.

Incidents already on record

The report lists dozens of cyber incidents worldwide since August 2025. Among the Dutch cases, Russian state hackers broke into WhatsApp and Signal accounts of government employees worldwide in March 2026 and gained access to sensitive information of Dutch officials. A month later, attackers stole the personal data of almost all residents of the municipality of Epe from its servers. In the same period, a hack at telecom provider Odido exposed the data of more than 6 million former and current customers, one of the largest data thefts in Dutch history. The NCTV also cites the cyberattack on Ahold Delhaize in October 2026, which cost the supermarket group 200 to 250 million euros in revenue, left shops with empty shelves and kept websites and apps offline for days. Its subsidiary Delhaize was hit by another hack in early November.

Government and business response

Dutch organisations and companies are not acting fast enough, the NCTV says. A third of organisations have no or minimal detection, so intruders are noticed only after the damage has been done. Small and medium-sized businesses lag furthest behind, and the report describes a stubborn resilience gap between them and large firms that deliver critical services. The coordinator looks to government to support smaller companies.

On Friday the cabinet presented an action programme on future-proof digital resilience, setting out goals and actions for government and business. After the cabinet meeting, Justice and Security Minister David van Weel (VVD) was asked whether protection against cyberattacks remains possible now that AI makes vulnerabilities easier to exploit. He said he thinks it does:

“Because AI also helps us find those vulnerabilities, in the defensive sense of the word.”

Van Weel urged companies and organisations to use the newest technology to defend their networks and called the report worrying. He also said that some people argue the country needs a cyber version of 9/11 to wake everyone up.

“Some say we need a cyber version of 9/11 to wake us all up. I hope not.”

The NCTV expects the number of cyber incidents to rise sharply in the coming years unless digital resilience improves significantly, and it says AI will change the cyber landscape in the years ahead.