THE Dutch Institute for Vulnerability Disclosure (DIVD), a non-profit organisation that works on identifying and disclosing security vulnerabilities, says it has been hacked. In a LinkedIn statement, DIVD said it detected suspicious activity, investigated it and placed its infrastructure into incident-response mode. It has blocked access to its infrastructure and begun a forensic investigation with assistance from an independent incident-response team.
DIVD said the attack’s apparent modus operandi indicates it may have been powered by “agentic AI”, but stressed that the investigation is still under way and that it cannot yet rule anything out. The organisation is therefore treating the incident as a worst-case scenario and assuming a breach until evidence shows otherwise. The statement did not provide details about the suspected attackers, the systems affected, the data involved or whether information was accessed or stolen.
DIVD said it had informed directly involved parties, reported the incident to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and the National Cyber Security Centre, and discussed its options with police. Its immediate priorities are keeping its infrastructure isolated and secure, conducting the forensic investigation and supporting its volunteers. The organisation said it planned to publish its next update on Monday 28 September, or sooner if there was significant new information.