Dutch vulnerability-disclosure group says it was breached in apparent AI-agent attack

On 24 September 2026 the Dutch Institute for Vulnerability Disclosure (DIVD) said it had found suspicious activity and concluded that it had been hacked, after almost seven years of operation. The organisation said it blocked access to its infrastructure and began a forensic investigation with a third-party incident-response team. DIVD said it had informed the parties directly involved, reported the incident to the Dutch data protection authority, the Autoriteit Persoonsgegevens, and to the National Cyber Security Centre, and discussed its options with the police.

DIVD said the modus operandi indicates an agentic, AI-powered attack. BleepingComputer, reporting on 29 September and quoting a later DIVD statement, said the organisation described the attack as loud and "very very messy", and said an agent chose each next step itself. According to the same report, DIVD said initial access came through a technical vulnerability, and that the vulnerability was not in Citrix NetScaler. The later statement is known here through BleepingComputer's account rather than directly.

Much remains unsettled. In its original disclosure DIVD said the investigation was still ongoing and that it could not yet rule anything out. The description of the attack as agentic is DIVD's own assessment, based on the pattern of activity, and has not been independently confirmed. The vulnerability used for initial access has not been identified beyond what it was not, and the evidence available does not say what, if any, data was affected or who was responsible. According to BleepingComputer, DIVD said a fuller update would come on 1 October.