Chinese hack group targets Dutch internet providers, intelligence agencies confirm

Dutch intelligence agencies confirmed on Thursday that the country was targeted in the global cyberespionage campaign carried out by the Chinese state-linked hacker group Salt Typhoon. The campaign, which came to light in late 2024, focused on the international telecommunications sector.

The Dutch Military Intelligence and Security Service (MIVD) and the General Intelligence and Security Service (AIVD) said they independently verified portions of a U.S. investigation attributing the campaign to Salt Typhoon. “We can confirm parts of the U.S. findings through our own intelligence,” the agencies stated.

The warning aligns with alerts issued by the U.S. National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA), and Federal Bureau of Investigation (FBI), as well as European intelligence services including Germany’s BND, Finland’s SUPO, the U.K.’s NCSC, and Italy’s AISE.

In the Netherlands, the targets were smaller Internet service and hosting providers rather than the major telecom operators. Investigations by the MIVD and AIVD indicate that the hackers gained access to routers of Dutch targets but, as far as is known, did not penetrate internal networks further. Where possible, the agencies and the National Cyber Security Centre (NCSC) shared threat information with affected organizations.

The agencies emphasized that China’s cyber activities have become increasingly sophisticated. “These activities are now so advanced that continuous effort and attention are needed to detect and counter cyber operations against Dutch interests,” the MIVD and AIVD said. They added that while proactive measures can reduce risk, complete prevention is not possible, posing a significant challenge to national cyber resilience.