Benelux’s Digital Ambitions Undermined Without Robust Cyber Defences
25th November 2025 • Novotel Amsterdam City, Netherlands
Cybersecurity continues to be the missing pillar of many countries’ digital ambitions. What needs to be done?
A troubling pattern of vulnerabilities
In July 2025, a serious cybersecurity incident struck the Dutch Public Prosecution Service (Openbaar Ministerie, OM), revealing the fragility of even the most critical national institutions.
As a result of a suspected breach, the OM remains disconnected from the internet indefinitely — a measure taken to contain and investigate the intrusion. Prosecutors are unable to send or receive emails, log in remotely, or even edit or print legal documents. Court proceedings are expected to face delays, and public confidence is under pressure.
This incident is not isolated. It forms part of a broader wave of cyberattacks affecting the Benelux region in 2025.
Luxair (Luxembourg, April 2025): the national airline suffered a ransomware attack that grounded flights for nearly two days. Attackers exploited a misconfigured VPN appliance.
Belgian Ministry of the Interior (May 2025): hackers accessed sensitive documents by exploiting an unpatched vulnerability in the Ministry's document management system.
Port of Rotterdam (June 2025): a supply chain attack disrupted port logistics when malware was introduced via a customs broker’s software update.
Together, these events demonstrate not only growing attacker sophistication but also serious vulnerabilities in public and private digital infrastructure. For CISOs, the implications are urgent and strategic.
• Incident response plans must cover prolonged disconnection scenarios — not just recovery and restoration.
• Visibility into endpoint and third-party environments is vital, especially for government agencies that may be targets of nation-state actors or politically motivated hacktivists.
• Legacy systems and exposed remote access points remain key attack vectors. Regular configuration audits are critical.
• Patch management failures offer easy wins to attackers. CISOs must implement faster update cycles and use attack surface monitoring tools.
• Cyber supply chain risk is a huge challenge. Trust boundaries must be re-evaluated, and vendors continuously assessed.
• Critical operations should be decoupled from external systems wherever possible.
• Slow detection & response are still a problem. CISOs must improve real-time threat detection and internal threat hunting capabilities. The Dutch NCSC discovered the OM breach before internal teams did.
• Crisis management readiness: the OM is still offline weeks later/ Incident response and resilience must go beyond disaster recovery and into sustained continuity planning.
In the Benelux region, governments pride themselves on high levels of digital public service delivery. Corporations also have committed to high levels of digitalisation. But these levels of digitalisation must be backed up by solid security. Without this, public trust in institutions and companies will be eroded, and the benefits of digitalisation will be damaged by the costs of repeated clean-ups.
