Dutch Data Breaches Surge 58% in 2025, Driven by AI-Powered Phishing and Supply Chain Attacks The Netherlands saw a sharp rise in cyberattack-driven data breaches in 2025, with incidents jumping 58% to 2,428 up from roughly 1,500 in 2024 according to the Dutch Data Protection Authority’s (AP) Datalekkenrapportage 2025, published on July 10. The report attributes the surge to AI-powered phishing kits, which enable criminals to craft convincing, personalized lures without technical expertise, bypassing traditional detection methods. ### Key Findings: The Shifting Threat Landscape - Account takeovers nearly tripled, rising from 607 in 2024 to 1,742 in 2025, as phishing evolved from a post-breach tactic to a primary attack vector. - Ransomware incidents (136 attacks) generated 283 breach notifications, but one attack on AddComm, a Dutch customer communications firm, triggered 5,407 downstream notifications highlighting the cascading impact of supply chain compromises. - AI-driven phishing kits eliminate the grammar errors and generic formatting that once flagged fraudulent messages, while adversary-in-the-middle (AiTM) attacks intercept multi-factor authentication (MFA) codes in real time, bypassing standard security measures. ### The AddComm Breach: A Case Study in Supply Chain Risk Between May 5–17, 2024, attackers breached AddComm, a vendor handling sensitive documents for banks, utilities, and other services. The ransomware attack exfiltrated customer data, forcing downstream organizations including ABN Amro to file breach notifications throughout 2025. The incident underscores how a single vendor compromise can trigger thousands of regulatory obligations under GDPR. ### Regulatory Warnings and GDPR Enforcement The AP’s report serves as a direct enforcement signal, warning that organizations relying on legacy monitoring tools risk violating GDPR Article 32 which mandates "appropriate technical and organizational measures" to protect data. Fines for non-compliance can reach €10 million or 2% of global turnover, with severe violations capped at €20 million or 4%. The authority emphasizes that executives not just IT teams must prioritize cybersecurity, as the threat environment has fundamentally changed. With the Dutch Cyberbeveiligingswet (NIS2 implementation) taking effect on August 15, 2026, organizations face a tightening compliance deadline. ### The AI Phishing Flywheel The report details how AI-powered phishing kits create a self-reinforcing cycle: 1. Personalized lures use breached data to craft contextually accurate messages. 2. Commoditized toolkits lower the barrier to entry, enabling non-technical attackers to deploy sophisticated campaigns. 3. Stolen credentials feed AI systems, improving future attacks. Traditional email filters, calibrated to detect human errors, are now ineffective. The AP urges organizations to adopt behavioral monitoring (e.g., detecting unusual login patterns) and phishing-resistant MFA (e.g., FIDO2/WebAuthn) to counter these threats. ### Broader Implications for the EU As one of the EU’s most digitally advanced nations, the Netherlands’ breach trends serve as a leading indicator for the region. The 58% spike in cyberattack-driven breaches suggests a broader shift in the EU’s threat landscape, with AI-driven attacks and supply chain risks becoming dominant concerns.