Cyber Security Council: The Netherlands vulnerable to attack on digital infrastructure
The Netherlands possesses one of the best digital infrastructures in the world. But how robust is that infrastructure if the power goes out for an extended period or critical networks are hit? Less robust than is often thought, warns the Cyber Security Council (CSR).
In the advice Connection under pressure, Based on research by TNO, the council points out five vulnerabilities in the Dutch telecom and internet infrastructure. It advises the Cabinet to address these risks immediately in order to strengthen the resilience of the digital infrastructure.
The investigation was prompted by global geopolitical unrest, and in particular the increasing cyber threat from Russia and China. The CSR refers to the AIVD's 2025 annual report, which states that the Netherlands is experiencing the greatest security threat in decades.
Greater geographical distribution
The first vulnerability is the lack of geographical distribution of companies involved in digital infrastructure. Most data centers and internet exchanges in the Netherlands are located in the Amsterdam region. If multiple components of the digital infrastructure are located in the same area, a single incident can affect several networks simultaneously. The council therefore advocates for greater distribution and alternative connections, so that it is possible to reroute data traffic along another route in the event of a failure.
Impending power outage
The researchers warn that dependence on electricity also poses a risk. Telecom networks require power, while energy companies increasingly rely on digital communication for their operations. In the event of prolonged outages, problems in both sectors can reinforce each other. The CSR therefore advises energy and telecom companies to make better agreements regarding emergency provisions, priorities, and cooperation during crises.
Taking over users
A third vulnerability is the limited option to switch providers in the event of outages. There is no national regulation whereby providers automatically take over each other's users in the event of a prolonged mobile network failure. The council believes that such an option should exist for critical communication.
Expand the number of emergency facilities
The CSR calls on the Cabinet to improve emergency power capacity and increase recovery capability. The current number of emergency provisions, such as batteries and generators, is limited and not sufficient everywhere to cope with prolonged power outages. In the event of a nationwide or European 'blackout'‘ this can cause problems.
Strengthening sovereignty
Finally, the council advocates for greater market diversification and the safeguarding of vital data and networks within Europe. Many Dutch companies depend on foreign suppliers for parts of their digital infrastructure and services. Particularly for vital processes, this dependency can undermine resilience.
The internet, energy, and critical services are so closely intertwined that an outage in one location can quickly affect other parts of the infrastructure. By taking timely measures, the government prevents a local disruption from escalating into a national crisis.
Sources
- AIVD Annual Report 2025
- CSR advisory report Connection under pressure
- IMD World Competitiveness Ranking 2026
Related events
Read further