Signals · Threat intelligence

Eight signals Dutch manufacturers should be watching

Ransomware, exposed edge devices, suppliers and state actors: the signals that come before a cyber attack on Dutch industry, and what to do about each one.

By Gouresh Kamble, Amon Dîn · · 5 min read

On 1 August, CEVA Logistics told bol that it might have suffered a data breach affecting orders shipped from one of bol's distribution centres. Bol and de Bijenkorf warned customers that their data may have been exposed and that orders could be delayed or cancelled, and it was early September before most were delivering normally again from the Waalwijk site. Bol says its own systems were not hit. Their supplier's were.

For a Dutch manufacturer, that is the shape of the risk in 2026. Attacks rarely arrive without warning; the signals are public, if you know where to look. Here are eight worth watching.

Eight signals to watch

1. Ransomware is aimed squarely at manufacturing. Dragos counted 1,140 ransomware incidents against industrial organisations in Q2 2026, up 12% on Q1, and 747 of them (65%) hit manufacturers. It saw no case where attackers manipulated a control system: production stopped because the ERP, virtualisation and identity systems that OT depends on were encrypted or shut down. Action: test whether you could keep producing, or restart safely, without ERP for a week.

2. Edge devices are being exploited now. On 27 September the NCSC warned that two Citrix NetScaler ADC and Gateway vulnerabilities were already being exploited, one allowing unauthenticated remote code execution. Today, CISA added an Ivanti Connect Secure authentication bypass (CVE-2026-104935) to its Known Exploited Vulnerabilities catalogue. VPNs and gateways are how engineers and vendors reach the plant. Action: keep a current list of every internet-facing device, and patch exploited flaws within days, preserving logs first as the NCSC advises.

3. Your suppliers are part of your attack surface. CEVA is the local example. ENISA's Threat Landscape 2025 describes criminals deliberately abusing dependency points in the supply chain to magnify impact. Logistics partners, MES and ERP vendors and machine builders with remote access all count. Action: name your critical suppliers and agree what each must tell you, and how fast, if they are breached.

4. Dutch technology is an espionage target. The AIVD annual report says state actors want Dutch knowledge and technology, and that intelligence work in 2025 revealed concealed investments, evasion of export restrictions and trade secrets obtained through (cyber) espionage. Action: identify your crown jewels (designs, recipes, process data) and check who can reach them.

5. Sabotage risk is rising, cautiously. The AIVD and MIVD found no successful Russian cyber sabotage in the Netherlands in 2025, but describe the country as a potential target because of its support for Ukraine and its role as a transport hub, with a cautious increase in sabotage activity since summer 2025 aimed mainly at military and logistics targets. Defence suppliers and logistics-heavy manufacturers sit closest to that. Action: if you supply defence or critical logistics, brief your board on it and test your manual fallback.

6. Hacktivists go for exposed control panels. A joint advisory by CISA, Europol's EC3 and European partners describes pro-Russia groups scanning for internet-facing VNC connections to HMIs, logging in with default or weak passwords and changing setpoints or disabling alarms. Their methods are unsophisticated, which is exactly why they work. Action: make sure no HMI or PLC is reachable from the internet, and change every default password.

7. Phishing and vishing remain the front door. ENISA found phishing, including voice phishing, behind about 60% of initial intrusions, and AI-supported campaigns dominate social engineering. A convincing call to the helpdesk is often enough. Action: require call-back verification before any password reset or MFA change.

8. The Cyberbeveiligingswet is now in force. Since 15 August 2026, the Dutch NIS2 law applies, and in-scope organisations must register with the NCSC. The RDI, which supervises manufacturing, notes that in-scope manufacturers must report significant incidents within 24 hours and train their executive board, and that supply-chain risk, incident reporting and board training are where the sector scores itself lowest. Action: check whether you are in scope, register, and rehearse the 24-hour report.

Attacks rarely arrive without warning. The signals are public, if you know where to look.

Early warning signs inside your own environment

  • Failed or unusual logins on VPNs, gateways or remote-support tools, especially out of hours
  • New administrator accounts, or remote-access tools nobody remembers installing
  • Security software disabled or uninstalled on servers
  • Large or unusual outbound transfers from file servers, ERP or engineering shares
  • Helpdesk requests to reset passwords or MFA for executives or engineers
  • HMI changes, alarms cleared or setpoints moved that no operator can explain
  • A supplier reporting an incident, or going quiet

How Amon Dîn helps

Amon Dîn provides independent threat intelligence and OT-aware security advice for manufacturers. We monitor the signals that matter to your sector, including exposed credentials, impersonation and activity against your suppliers. We run discovery sessions that map what you actually have, from internet-facing devices and remote access routes to OT connections and third-party dependencies. We advise on segmentation, monitoring and incident readiness, including your Cyberbeveiligingswet obligations. If you are not sure where to start, the free Signal Score is a quick first read.

Sources

← All Signals