AI increases the dangers of phishing and cyberattacks, says Dutch data authority

The rapid development of artificial intelligence (AI) is increasing the risks of phishing and cyberattacks, and organizations need to immediately "take action" to get their cybersecurity in order, the Dutch Data Protection Authority (AP) said in a report on Wednesday. Without taking measures, organizations will fail to protect data against increasingly sophisticated forms of cybercrime, the regulator said.

Last year, the AP recorded a sharp increase in the number of reports filed where criminals successfully managed to takeover an account. This nearly tripled from 607 in 2024 to 1,742 last year. Account takeovers mean phishing attacks are no longer merely the consequence of a data breach, but are increasingly becoming the cause.

Phishing is a form of cybercrime in which criminals send authentic-looking communication to potential victims, including via email. Fake links in phishing messages can lead to the takeover of the victim's account. When employees of an organization are successfully targeted, their account can be used by criminals to launch a much more substantial cyberattack.

Criminals are making the content of these fake messages increasingly realistic using AI. By using information obtained from previous data breaches, criminals can craft personalized phishing emails containing the name and contact details of the potential victim, for example.

Despite AI's capabilities to combat cybersecurity vulnerabilities, criminals can use the same methods to detect and exploit those weaknesses. Due to this interplay, the AP considers it "essential for organizations to bring their digital protection up to standard." The privacy watchdog is appealing for organizations to develop a general cybersecurity policy and advised against storing data centrally.

The privacy regulator received a total of 39,407 notifications of data breaches last year. The number of notifications is continuing to rise, but at a rate that is less harsh than in 2024. The AP received 37,839 notifications of data breaches that year, nearly 50 percent more than in 2023.

The AP only started allowing organizations to report multiple data breaches at once in 2024, such as letters sent to the wrong person. According to the AP, organizations have been reporting more data breaches since then.

Data breaches are causing unrest and problems in society, the AP believes. The regulator cited last year's breach of a database from the cervical cancer screening program, which than caused people to hesitate about their continued participation.

Further, a leak at the Public Prosecution Service delayed court cases and prevented civil servants from sending emails for an extended period. "Due to these types of data breaches, people lose confidence in the digital services provided by companies and governments," the AP stated.