Dutch Police and NCSC Operation Shuts Down A Botnet With 17M Devices

A significant success for Dutch law enforcement and cybersecurity authorities: Dutch Police and the National Cyber Security Centre (NCSC) have taken down a large botnet following a report from a security researcher. The investigation identified 200 servers located in the Netherlands that were used to support the network's infrastructure.

During the operation, police seized a number of the servers, after which the hosting provider shut down the entire infrastructure. According to the NCSC, the network was linked to at least 17 million infected devices and had been used to facilitate cyberattacks while concealing their origin.

The operation was announced jointly by the NCSC and Dutch Police on 28 May 2026. In related news, the NCSC's annual Cybercrime Monitor reported that cyberattacks against Dutch companies have fallen to their lowest level in the past nine years.

https://bit.ly/4uQXwq5

https://bit.ly/3RNjeN6

Keynotes:

"Dutch police say they dismantled a large botnet this week comprising at least 17 million infected devices."

"...police began an investigation, which resulted in the discovery of 200 servers underpinning the botnet's infrastructure located in the country."

"...NCSC-NL published its annual Cybercrime Monitor report, which revealed cyberattacks on Dutch companies had fallen to the lowest level in nine years."

PowerSchool Hack

A 19-year-old college student from Massachusetts, has been sentenced to four years in prison after pleading guilty to hacking PowerSchool, a software platform used by schools across the United States to manage student information. He gained unauthorized access to the system and stole a massive amount of sensitive data belonging to 60 millions students and 9 million teachers; including personal identifiers, medical details, and educational records.

After gaining access, he contacted the company and demanded $2.85 million in Bitcoin (30 bitcoin), threatening to release the stolen data online if his ransom demand was not met.

PowerSchool confirmed that multifactor authentication (MFA) was not enabled on some of its systems at the time of the incident. This admission became a key detail in understanding how he was able to compromise the system so effectively.

https://bit.ly/4hcfhKo

Headlines:

"...He accessed databases belonging to the company PowerSchool that had information on more than 60 million students and nine million teachers."

"Sensitive data, including students’ Social Security numbers, special education status, medical conditions and parental restraining orders, were exposed in the hack, which PowerSchool made public in January."

"Last month, Texas sued PowerSchool, saying the company broke state laws relating to deceptive trade practices and identity theft protection, including by misleading consumers into believing its shoddy security practices were 'state-of-the-art.'

PowerSchool has acknowledged the hack was enabled by the fact that it did not use multifactor authentication."

UK Fines Law Firm 60,000 Pounds for Ransomware Data Breach

Two things:

1) DO NOT ignore two-factor authentication for any user. Just one weak link can cause you £60,000 (or more).

2) Report breaches on time, in accordance with the law(s) you are required to obey.

The U.K. ICO (Information Commissioner's Office) fined a law firm £60,000 after a 2022 ransomware attack leaked sensitive client data, including DNA tests and information about children and victims. The investigation found that the law firm failed to protect data properly, used an outdated account without two-factor authentication, and waited too long to report the breach. The ICO said protecting personal information is a legal duty, and the firm’s mistakes led to serious risks. The firm can appeal the fine but has not commented yet.

https://bit.ly/3YFvYFO

Headlines:

"Firm Failed to Close Outdated User Account, Waited 43 Days to Notify Regulators"

"Hackers in a 2022 ransomware attack stole 32.4 gigabytes of data from the law firm and later posted on the darkweb. The breach affected 791 people and contained information about 306 clients including DNA testing data, details on children and victims of sexual offenses."