DigiD DDoS shows how little availability headroom the Dutch national login has left
A DDoS attack on October 30 left DigiD only partly reachable for about 90 minutes, blocking logins to the Dutch tax office and MijnOverheid. Government figures show DigiD availability down to 99.57% this year against a 99.5% norm.
A DDoS attack on Friday, October 30 left DigiD, the Dutch government login run by Logius, only partly reachable from 13:22 until about 14:49, according to TPO, blocking many sign-ins to the Tax Administration and MijnOverheid on the day before quarterly VAT returns were due. Government websites stayed online. Logius filed a police report, and nobody has claimed the attack. Figures from State Secretary Eric van der Burg show DigiD availability falling from 99.93% in 2024 to 99.65% in 2025 and 99.57% through August 2026, against a 99.5% norm; he has said attacks this year have been more targeted. Biometric Update reported on November 4 that Logius says no personal data was exposed, that a resilience review is under way, and that the Netherlands Digital Service plans to trial hosting DigiD on a sovereign government cloud in 2027.
Why it matters
No credential was stolen, but availability is an identity property when one login fronts a whole country's services. DigiD is the gate to tax, benefits and other public services, so 90 minutes down on a filing deadline is an outage for every one of them, and the 2026 figure leaves 0.07 percentage points above the norm with four months still to count. Our Netherlands digital ID profile covers how DigiD works, and the coming EU Digital Identity Wallet adds another dependency to plan for.
For services that rely on a national eID, the lesson is to plan for the provider being down: publish how deadlines are handled during an outage, and keep a supported alternative for urgent cases. During outages, remind users to sign in only from the official DigiD site, because downtime is a natural phishing lure for the account takeover that follows.
Source: Biometric Update, TPO
Related on Start with Identity
- BlogAmerica.gov launches as an AI front door to federal services, with Login.gov as its sign-in
GSA and the White House National Design Studio launched America.gov, an AI-assisted entry point to federal services. The executive order behind it makes Login.g
- Blog24,650 exposed server management interfaces leak crackable password hashes before login
Firmware security firm Lava found that 67 percent of 36,872 internet-exposed Baseboard Management Controllers hand over IPMI authentication hashes before a logi
- BlogA 9.8-CVSS vCenter authentication bypass has no workaround, only an emergency patch
Broadcom shipped emergency fixes for three critical VMware flaws, including CVE-2026-59309 (CVSS 9.8), which lets any attacker with network access to vCenter by
- RecipeAdd login to a Next.js app with OIDC
A complete, copy-paste OpenID Connect login for the Next.js App Router using authorization code flow with PKCE, server-side token exchange, and httpOnly cookies
- CVECheck Point SmartConsole login hands an unauthenticated attacker an admin token
A flaw in the Check Point SmartConsole login process let an unauthenticated attacker obtain an application login token and sign in to the Management Server as a
- ArticleHeadless CIAM and API-First Authentication: When to Own the Login UX
Headless CIAM gives you identity as APIs and SDKs while you build every login screen yourself. This guide explains what headless means, when owning the UX pays