DigiD hit by DDoS attack, Logius says personal data was safe

DigiD, the Dutch government’s digital login system, was hit by a DDoS attack that briefly left several services unreachable, NU.nl reports. Logius, the government organisation that runs DigiD, says the problems are now under control and that no personal data was at risk.

What happened

The attack made it impossible for many people to log in. A spokesperson for Logius told NU.nl: “Because of the attack, a large part of the people who use DigiD had no access to the app or website.” The same picture appeared on Allestoringen.nl, the Dutch outage-tracking site, where tens of thousands of people reported problems logging in through the DigiD app.

Logius has since brought the situation under control, according to NU.nl. The spokesperson said clearly that this was a DDoS attack and not a hack. That difference matters. In a DDoS attack, short for distributed denial of service, a server is flooded with internet traffic until it slows down or stops responding. As NU.nl explains, the attackers do not try to break into the systems. The aim appears to be disruption. Because nobody got inside DigiD, Logius says personal data was never in danger.

Nobody yet knows who carried out the attack. Logius has filed a police report so that investigators can try to find out. The organisation told NU.nl that reporting to the police is its standard policy after attacks like this one.

The attack was not a one-off of its kind. NU.nl notes that DDoS attacks on digital government services happen more often.

Why it matters if you live in the Netherlands

For anyone who lives in the Netherlands, DigiD is hard to avoid. It is the login you use with many government bodies and with organisations that work with them. Internationals often meet it within weeks of arriving, because so much of Dutch administration happens online. When DigiD goes down, the services that depend on it go down with it, even if their own websites are working normally. That is why NU.nl’s headline speaks of several services being briefly unreachable, even though only DigiD was attacked.

The most useful news for residents is what did not happen. According to Logius, this was not a break-in, so your DigiD account details and the personal information behind them were not exposed. If you could not log in during the attack, the cause was the flood of traffic, not anything wrong with your account. Logius told NU.nl that the problems are under control, so a task that failed during the disruption should work if you try it again.

There is also a practical lesson here. Since NU.nl reports that attacks on government services happen more often, it makes sense not to leave important online tasks until the last moment before a deadline. If DigiD is unavailable for a while, you will have time to try again once service is back.

For people who are new to Dutch digital systems, the Allestoringen.nl reports are worth remembering too. NU.nl cites the site because tens of thousands of users reported problems there. If DigiD will not let you in, a quick look at an outage tracker can tell you whether the problem is with you or with the service.

What to watch next

The biggest open question is who was behind the attack. Logius has filed a police report, and any progress in identifying the attackers will most likely come through that investigation. NU.nl’s report does not say when results can be expected.

It will also be worth watching whether the attack happens again. NU.nl points out that DDoS attacks on digital government services are not new, and each one tests how quickly the organisations behind them can restore access. This time, Logius brought the disruption under control and reports no risk to personal data.

Residents should also watch for any further updates from Logius. NU.nl’s report is based on the spokesperson’s statements, so official follow-ups are the best way to confirm whether services are fully stable and whether anything more is learned about the attack.

Until then, the official message is reassuring. DigiD was knocked offline for a short time, but according to Logius nobody broke in and no data was taken. For the many people in the Netherlands who depend on it, the main cost was a few hours of frustration rather than a security breach.

Source: NU.nl Tech