DIVD Breach: Agentic AI Attack Hits Dutch CVD Team

Fri Sep 25

The Dutch Institute for Vulnerability Disclosure just became the story it usually helps write. On September 24, 2026, DIVD CSIRT published a blunt notice: suspicious activity, investigation, then the conclusion — they got hacked. The modus operandi, they said, indicates an agentic AI-powered attack. For a volunteer-driven CVD nonprofit that has spent almost seven years chasing other people’s vulnerabilities, that sentence is the whole plot twist.

This is a verified DIVD data breach disclosure. The organization blocked infrastructure access, brought in a third-party incident response team for forensics, told directly involved parties, and reported to the Autoriteit Persoonsgegevens and the Dutch National Cyber Security Centre. Police options were discussed. The affected-person census is unpublished. This article will not invent one.

Canonical catalog entry: DIVD agentic AI attack 2026 (also /divd/divd-agentic-ai2026). Trade coverage from DataBreaches.net mirrors the same CSIRT facts without adding a headcount.

What happened in the DIVD breach 2026

DIVD’s own framing is hard to soften. Security people say it is a matter of when, not if. After nearly seven years, DIVD wrote, the hackers got hacked. They noticed suspicious activity, investigated, and reached the inevitable conclusion.

What followed is textbook responsible disclosure applied to themselves. Full incident response mode. Access to infrastructure blocked. Forensics opened with outside help. Transparency chosen over damage control — “open, transparent and honest, even if it sucks,” in their words.

The technical claim that makes this incident different from a routine CVD-org compromise is the attack style. DIVD said this is not remarkable because it is their first breach. It is remarkable because the modus operandi indicates an agentic AI-powered attack — a pattern the team says it has not seen before. Investigation is ongoing. Until forensics say otherwise, they are treating the event as a worst-case scenario and assuming breach.

That assume-breach stance matters more than any speculative malware name. When a CVD shop says it cannot rule anything out, partners, reporters who work with DIVD, and any volunteer whose credentials or case notes touch DIVD systems should treat lateral movement and data access as possible until proven narrow.

Timeline (what is public)

Detection: DIVD notices suspicious activity and opens an internal investigation (exact first-compromise calendar date not published in the September 24 notice).
Conclusion: investigation confirms unauthorized compromise — “damn, we got hacked.”
Containment: infrastructure access blocked; third-party IR forensics engaged.
September 24, 2026: public CSIRT notice published; directly involved parties informed; Autoriteit Persoonsgegevens and NCSC notified; police options discussed.
Next public update: Monday September 28, 2026, or sooner if there is more to share.
Press contact: Marieke Rijken, [email protected].

Gaps in that timeline are deliberate. Dwell time, entry vector beyond “agentic AI” labeling, which systems were touched, and which data classes moved are still in the forensic hopper. Early CVD-org disclosures often look like this: strong confirmation, careful silence on unfinished scope.

What “agentic AI-powered attack” means here

DIVD did not publish a white paper with tool names, prompt chains, or model providers. Readers should not fill that vacuum with fan fiction. What the notice does establish is operational judgment from an experienced CSIRT: the behaviors they observed look like an agentic AI-driven campaign — automated, adaptive, and unlike prior incidents in their history.

In plain English, agentic AI attacks are not “someone used ChatGPT to write a phishing email.” They are campaigns where autonomous or semi-autonomous agents can plan steps, try tools, retry failed paths, and chain reconnaissance with exploitation without a human clicking every button. That can mean faster credential spraying, smarter social engineering copy, automated privilege-check loops, or scripted lateral movement that adapts when a door is locked.

What this is not: a confirmation that a specific commercial AI product was abused, that a named ransomware crew claimed DIVD, or that a dump is already circulating. None of that appears in the primary notice. The verified floor is narrower and still serious — DIVD was compromised, the MO points to agentic AI, forensics are live, worst-case assumed.

Why a CVD nonprofit is a high-value target

Coordinated vulnerability disclosure organizations sit on sensitive operational context even when they are not banks or hospitals. Case workflows can involve researcher identities, vendor contacts, embargo timelines, unfixed vulnerability details, infrastructure tickets, and volunteer communications. Steal that map and you get a shortcut into other people’s patch queues — or material for highly tailored phishing against the same vendors DIVD was trying to help.

Attackers who want a research org’s trust graph do not need a consumer census to make the intrusion worth it. That is why an unpublished headcount does not make the DIVD breach 2026 small. It makes the public risk profile incomplete.

What data was exposed — and what remains unknown

Verified: DIVD was hacked. Infrastructure access was blocked. Third-party forensics are underway. Directly involved parties were informed. Dutch DPA and NCSC were notified.

Unpublished: any records-affected or people-affected number. Field-level inventories of personal data, volunteer files, vendor correspondence, vulnerability case notes, or system credentials. Exact entry vector beyond the agentic-AI modus operandi description. Whether encryption, data exfiltration, or both occurred.

Honest inventory until the next update:

Compromise of DIVD — confirmed by DIVD CSIRT
Agentic AI-powered attack indicators — stated as modus operandi by DIVD
Assume-breach posture — explicit until proven otherwise
Personal-data categories and census — unpublished
Named ransomware brand or leak-site claim — not in the primary notice

If a viral post invents “X thousand volunteers” or “Y million records,” treat it as noise. The authoritative next signal is DIVD’s Monday update — or an earlier notice if forensics move faster.

Who is at risk

Directly involved parties DIVD already contacted

DIVD said it informed parties directly involved. If you received an official note from DIVD or Marieke Rijken’s communications channel, treat that as the live track — not a stranger’s DM claiming to “confirm your case.” Follow the instructions in the official message and verify any follow-up link by typing known DIVD domains yourself.

Volunteers and researchers

Volunteer-driven CVD work often mixes personal email, Matrix/Slack identities, VPN access, and ticket systems. If you volunteer with DIVD or shared credentials across research tooling, rotate passwords and MFA on anything that touched DIVD SSO, mail, or case platforms. Watch for phishing that name-drops the DIVD data breach and asks you to “re-enroll” or “verify volunteer status.”

Vendors and product security teams in DIVD cases

Product security contacts who coordinated fixes through DIVD should assume attackers may now know names, roles, and open-issue context. Require out-of-band verification for any urgent “DIVD needs a re-test login” or “embargo lifted early — upload patch notes here” message. Real DIVD process does not need you to paste secrets into a surprise portal.

Dutch residents and data subjects

Because DIVD reported to the Autoriteit Persoonsgegevens, personal-data exposure is on the regulatory table even while the census is unpublished. If you are a data subject who interacted with DIVD systems — reporter contact details, correspondence, or other PII — wait for official individual notice rather than trusting breach-check sites that invent matches. Dutch DPA processes and DIVD’s own updates will define notification duties once forensics clarify categories.

Broader CVD and bug-bounty community

Peers at other disclosure programs should treat this as a sector warning, not entertainment. Agentic automation lowers the cost of probing research orgs that historically relied on reputation and small-team ops. Harden help-desk callbacks, admin MFA, and secrets that live in volunteer laptops.

Industry context: AI agents meet real IR

2026 has already forced security teams to talk about AI agents that do more than draft emails. Separate public incidents — from agent-driven access mistakes to model evaluation breakouts — have made “autonomous tooling” a live IR category. DIVD’s notice adds a different datapoint: a respected CVD CSIRT saying the attack pattern itself looked agentic, and choosing full transparency while forensics run.

That matters for defenders who still treat AI risk as a policy slide. If autonomous agents can drive reconnaissance and intrusion loops, detection playbooks built for slow human operators miss tempo. Rate limits, anomaly detection on sequential tool use, and human approval gates for privileged actions become as important as classic AV signatures.

Compare carefully, without equating unrelated cases: AI-adjacent incidents this year show how agent tooling can touch unexpected systems when guardrails fail. DIVD’s case is not a claim that the same product or actor was involved. It is confirmation that a Dutch CVD institute judged its adversary’s MO as agentic AI-powered — and that Dutch regulators are already in the loop.

What DIVD and regulators have said

Primary source: DIVD CSIRT — “It was a matter of when, not if…” (24 Sep 2026). Key commitments in that notice: transparent handling, blocked infrastructure access, third-party IR forensics, assume-breach worst-case posture, notification of directly involved parties, reports to Autoriteit Persoonsgegevens and NCSC, discussion with police, priority on isolating infrastructure and supporting volunteers, next update Monday 28 September or sooner.

Spokesperson named: Marieke Rijken via [email protected].

DataBreaches.net summarized the same notice on September 25, 2026, emphasizing DIVD’s ethics and the agentic AI framing without adding an affected-person count.

No HIBP load, no Maine AG stub, and no company denial appear in these sources. This is DIVD speaking about DIVD. That is as verified as a nonprofit self-report gets.

What you should do

Concrete steps beat generic “monitor your accounts” advice. Tune them to whether you are a volunteer, vendor contact, or data subject waiting on notices.

Watch DIVD’s official channels for the September 28 update. Prefer csirt.divd.nl and messages from [email protected] over random Telegram “leak alerts.” Cross-check URLs by typing known domains.
If DIVD contacted you as a directly involved party, follow that notice. Do not forward sensitive case attachments into new “secure drop” sites advertised in breach chatter.
Volunteers: rotate credentials and revoke stale tokens. Password managers, Git tokens, VPN profiles, and chat session keys that touched DIVD ops should be refreshed. Turn on phishing-resistant MFA where available.
Vendors in open DIVD cases: freeze unexpected access requests. Call back through a known DIVD contact path. Treat embargo-breaking urgency as a social-engineering theme tied to the DIVD breach 2026 news cycle.
Assume phishing will name-drop “agentic AI” and DIVD. Expect emails like “Were you affected by the DIVD data breach — upload ID to check” or “NCSC/AP joint portal for DIVD victims.” Real Dutch authority portals are not delivered as surprise file-share links from Gmail lookalikes.
Do not trust invented record counts. The census is unpublished. Catalogs that show zero records mean unpublished, not proven empty.
Other CVD programs: review admin surfaces this week. Privileged volunteer accounts, CI secrets, and disclosure-platform SSO deserve an assume-breach drill even if you are not DIVD.
Press and researchers: use the named spokesperson path. Marieke Rijken at [email protected] is the stated channel. Do not harass individual volunteers for scoop details while IR is live.

Phishing examples tied to this incident

Attackers will weaponize the headline. Expect: “DIVD agentic AI attack — confirm your volunteer hours,” a PDF “Autoriteit Persoonsgegevens intake form” with a macro, or a call that claims to be NCSC needing your old case password “for correlation.” Hang up. Use published contact paths. DIVD already showed how transparent IR sounds; fake IR sounds like urgency plus a credential ask.

Help desks at vendor companies should refuse password resets driven solely by inbound mail that cites the DIVD breach. Ticket verification the requester cannot dictate, and manager approval for privileged changes, raise the cost of replaying stolen CVD context.

What we still do not know

Honest reporting means listing the blanks. DIVD has not published an affected-person count. Data-field inventories are unfinished. The precise compromise date and dwell time are not in the September 24 notice. No ransomware brand is confirmed there. Whether exfiltration occurred, and of what, awaits forensics. The “agentic AI” label is DIVD’s modus operandi assessment — not a full technical post-mortem yet.

Those unknowns should shrink on or before Monday September 28, 2026, if DIVD keeps its update promise. Until then, treat every spreadsheet of “DIVD victims” as unverified noise.

Assume-breach in practice for a CVD shop

When DIVD says it cannot rule anything out, partners should translate that into operational moves — not panic. Assume-breach means treating authentication material, shared mailboxes, disclosure-platform sessions, and case attachments as potentially hostile until forensics carve them out. It does not mean every personal email DIVD ever received is confirmed stolen. It means the burden of proof flipped: safety must be demonstrated, not assumed from silence.

For a coordinated vulnerability disclosure program, that flip is especially awkward because day-to-day work depends on trust with vendors under embargo. If attackers obtained even a partial ticket index, they can spoof “DIVD researcher follow-up” with accurate CVE-adjacent language. Product security teams should temporarily raise the bar for inbound DIVD-branded requests: known contact only, no new file drops, no emergency VPN grants without a calendar-confirmed call.

Internally, assume-breach also means isolating volunteer devices that held long-lived tokens. CVD work often lives on personal laptops. A compromised central platform can still leave residual risk on endpoints that synced mail or cached credentials. Volunteers who reconnect after isolation should expect password resets, session invalidation, and possibly rebuilt jump hosts — normal IR hygiene, not a suggestion they did something wrong.

Dutch regulator track: AP and NCSC

Reporting to the Autoriteit Persoonsgegevens puts the incident on the Dutch personal-data notification track under GDPR-style duties. Reporting to the National Cyber Security Centre puts national cyber coordination in the loop. Discussing options with police opens a criminal path if evidence supports it. None of those steps, by themselves, publish a victim census. They do signal that DIVD treated the event as more than a blog anecdote.

Readers outside the Netherlands sometimes confuse DPA notice with automatic public naming of every affected person. That is not how it works. Controllers assess risk to rights and freedoms, notify the supervisory authority when thresholds are met, and notify individuals when residual risk is high. DIVD’s September 24 notice confirms the authority reports; individual letters, if required, will follow forensic clarity. Until then, “was I affected” has only one honest answer for most people: unpublished.

NCSC involvement is also a cue for Dutch critical and enterprise defenders who partner with DIVD researchers. If your organization had an open DIVD case in recent months, brief your SOC on possible spear-phishing that cites those case IDs. Stolen context is more dangerous than a generic spam blast about the DIVD breach 2026 headline alone.

How this differs from leak-site marketing

Many 2026 catalog rows start as ransomware leak-site claims with no victim confirmation. This one is the opposite. DIVD volunteered the bad news before an extortion blog forced the narrative. There is no named encryptor in the CSIRT notice, no dump size, no countdown timer. The story is intrusion plus transparent IR plus an unusual MO label — agentic AI — not a monetized leak page.

That distinction should change how journalists and defenders talk about it. Do not paste DIVD into a “ransomware victims this week” roundup unless DIVD later says ransomware was involved. Do not equate unpublished census with “nothing sensitive.” CVD operational data can be sensitive without resembling a consumer SSN dump. Precision protects DIVD’s volunteers and keeps the public record usable.

Canonical record and sources

BreachHistory’s verified catalog row for this incident lives at https://breachhistory.com/divd/divd-agentic-ai2026. Relative path for on-site linking: /divd/divd-agentic-ai2026.

Primary and trade sources used for this write-up:

The DIVD data breach is a verified, self-disclosed compromise by the Dutch Institute for Vulnerability Disclosure, with an explicit agentic AI-powered attack assessment, regulator and NCSC notification, and an unpublished census. If you are waiting to learn whether your contact details or case files were involved, the next authoritative signal is DIVD’s forensic update — not a rumor thread. Until that lands, rotate access that touched DIVD systems, verify every urgent callback, and assume attackers will keep impersonating the same brand that just told the world it got hit.