# DigiD DDoS shows how little availability headroom the Dutch national login has left

Source: https://startwithidentity.com/blog/2026-11-04-digid-ddos-shows-how-little-headroom-the-dutch-national-login-has-left/
Last updated: 2026-11-04
License: content by Start with Identity. Cite the source URL.

---

A DDoS attack on Friday, October 30 left DigiD, the Dutch government login run by Logius, only partly reachable from 13:22 until about 14:49, according to [TPO](https://tpo.nl/2026/10/30/digid-ddos-storing-logius-belastingdienst/), blocking many sign-ins to the Tax Administration and MijnOverheid on the day before quarterly VAT returns were due. Government websites stayed online. Logius filed a police report, and nobody has claimed the attack. Figures from State Secretary Eric van der Burg show DigiD availability falling from 99.93% in 2024 to 99.65% in 2025 and 99.57% through August 2026, against a 99.5% norm; he has said attacks this year have been more targeted. [Biometric Update](https://www.biometricupdate.com/202611/ddos-attack-on-digid-exposes-fragility-of-dutch-government-login-backbone) reported on November 4 that Logius says no personal data was exposed, that a resilience review is under way, and that the Netherlands Digital Service plans to trial hosting DigiD on a sovereign government cloud in 2027.

## Why it matters

No credential was stolen, but availability is an identity property when one login fronts a whole country's services. DigiD is the gate to tax, benefits and other public services, so 90 minutes down on a filing deadline is an outage for every one of them, and the 2026 figure leaves 0.07 percentage points above the norm with four months still to count. Our [Netherlands digital ID profile](https://startwithidentity.com/digital-ids/netherlands/) covers how DigiD works, and the coming [EU Digital Identity Wallet](https://startwithidentity.com/glossary/eudi-wallet/) adds another dependency to plan for.

For services that rely on a national eID, the lesson is to plan for the provider being down: publish how deadlines are handled during an outage, and keep a supported alternative for urgent cases. During outages, remind users to sign in only from the official DigiD site, because downtime is a natural phishing lure for the [account takeover](https://startwithidentity.com/glossary/account-takeover/) that follows.

Source: [Biometric Update](https://www.biometricupdate.com/202611/ddos-attack-on-digid-exposes-fragility-of-dutch-government-login-backbone), [TPO](https://tpo.nl/2026/10/30/digid-ddos-storing-logius-belastingdienst/)