DDoS attack on DigiD exposes fragility of Dutch government login backbone - Biometric Update
A distributed denial-of-service (DDoS) attack on DigiD, the Dutch government login system, disrupted access for users on Friday, October 30, just before quarterly VAT returns were due.
The attack left thousands unable to access critical services, with outage tracker Allestoringen.nl logging about 4,500 complaints within 90 minutes. Services affected included the tax office and MijnOverheid, with Logius, which operates DigiD, confirming no personal data was exposed and filing a police report.
Recurring Problem
This incident is part of a troubling pattern for the Dutch government login system. On March 3, 2025, similar attacks left DigiD partially available on a key tax filing day, generating about 45,000 outage reports. The government has acknowledged that attacks on DigiD are becoming more frequent, complex, and targeted.
DigiD faces DDoS attacks every day and that most are mitigated, but acknowledged that more of them this year have had a real impact.
Declining Reliability
Government figures show DigiD's availability has been steadily declining, from 99.93% in 2024 to 99.65% in 2025 and 99.57% through August 2026. While these figures exceed the government's 99.5% availability standard, they exclude planned maintenance periods that critics say cause significant disruptions.
Dutch technologist Bert Hubert has criticized DigiD as a "shaky product" with frequent outages, noting that six-hour maintenance windows cause immediate problems at GP out-of-hours services and emergency departments. He also warned that DigiD runs on a commercial platform that could be acquired by untrusted parties.
Critical Infrastructure Concerns
DigiD serves as the central login for taxes, municipalities, benefits, health insurers, medical portals and fines, making it an attractive target for attackers. For a country that has moved much of public life online, this identity layer has become a single point of failure.
In response, Logius and the Belastingdienst recently conducted a joint exercise rehearsing DDoS defense. Longer term, the Netherlands Digital Service plans to trial in 2027 whether critical infrastructure like DigiD could be hosted on a sovereign government cloud, which would address concerns about commercial hosting but wouldn't prevent DDoS attacks.
What Happens Next
The immediate questions are who was behind the latest attack, whether attacks will continue around filing deadlines, and whether DigiD's full-year availability will remain above its own standard. Van der Burg's review of DigiD's resilience is ongoing, with the sovereign government cloud project representing a potential long-term solution to hosting concerns.
Related
