DigiD

Profile narrative

DigiD is the Dutch government login system that enables citizens to access a range of online public services. It provides secure authentication for services related to taxation, social benefits, healthcare and other governmental functions. The system is operated by Logius, an agency responsible for the Netherlands' digital infrastructure. DigiD’s headquarters is located in the Netherlands, reflecting its national scope and public‑sector mandate. A distinguishing attribute of DigiD is its specialisation as a government‑issued identity tool, which positions it as a critical component of the country’s e‑government strategy. The service benefits from robust DDoS protection measures and participates in an anti‑DDoS coalition aimed at strengthening resilience against large‑scale traffic attacks. These capabilities are intended to ensure continuous availability for the users who rely on DigiD for everyday interactions with the state.

On 14 January 2025, a large‑scale DDoS attack targeted multiple Logius‑managed services, including DigiD, generating exceptionally high traffic volumes that overwhelmed standard defenses and caused network overload. The resulting disruption prevented access to critical digital services such as tax filing, benefit claims and healthcare appointments for over five hours. Following the incident, the operator launched an investigation into the attack’s origin and is analysing collected data to design enhanced mitigation measures for future threats. Earlier, on 27 January 2018, a series of DDoS strikes hit several Dutch banks and the national tax authority, producing intermittent outages across financial‑sector online channels and a brief impact on the tax office’s web presence. During that same period, DigiD reported disruptions, although all affected organisations confirmed that no unauthorized access to customer data occurred. Although the 2018 attacks coincided with public revelations about Dutch intelligence operations against the Russia‑linked Cozy Bear group, experts noted that timing alone did not establish a direct causal link. Together, these episodes highlight the ongoing challenges faced by essential identity infrastructure in defending against volumetric cyber threats while maintaining public trust.

Incidents

2 incidents linked to this organisation.