An estimated 2.5 million people in the Netherlands fell victim to cybercrime or an online form of fraud, deception or intimidation last year, according to a new report by prosecutors and police that warns the threat is becoming harder to contain.
The Cybercrimebeeld Nederland, published every two years by the public prosecution department (OM) and the Dutch police, says offenders are increasingly working across borders and paying for whatever expertise they lack.
Technical skill is now widely for sale, the report says: ready-made tools, stolen data and services allow novice hackers to create complex attacks.
“Criminals combine data from earlier hacks with newly stolen data,” said Christa de Pagter, the national public prosecutor for cybercrime. Offenders use it to make more targetted attacks on victims, she said, often posing as a bank or crypto platform to pressure them into acting.
State actors blur the line
The report also revealed the growing role of state actors, which it says are increasingly entangled with criminal groups through hybrid warfare, eroding the line between cybercrime and national security. States can use criminals as proxies, directing them or supplying money and infrastructure.
In May, Dutch investigators arrested two men over servers used for Russian-linked cyberattacks; the report also cites two 17-year-olds detained last year for mapping wifi networks around government buildings in The Hague.
Lured through online games
Prosecutors and police also describe a new generation of young, Western cybercriminals, driven by money and status rather than ideology, who meet in loose online networks and specialise in data and cryptocurrency theft. They range in age from 11 to 25, police cybercrime lead Stan Duijf told broadcaster NOS.
Children are often lured in through online games such as Roblox, Fortnite and Minecraft, where they can be groomed in chat rooms. “It’s just like the schoolyard: they start with mischief,” Duijf said – but some go on to become cybercriminals.
The report highlights this year’s hack on Odido, which police believe a Dutch gang using the name ShinyHunters carried out, exposing the data of 6.2 million customers and prompting a €1 million ransom demand the firm refused.
AI is described as a “catalyst”: the report says it does not fundamentally change cybercrime but increases its speed and scale, and makes scam emails harder to spot.
