A distributed denial-of-service (DDoS) attack disrupted DigiD, the Netherlands’ government login service, for nearly an hour and a half on Friday afternoon, leaving many users unable to sign in. Logius, the government agency that manages DigiD, said the attack began at 1:22 p.m. local time and that the disruption was resolved at 2:49 p.m.
In a DDoS attack, a service is flooded with so much internet traffic that ordinary users end up, as a Logius spokesperson put it, at the back of a long queue. The spokesperson said logins worked only intermittently while the attack was under way. Within a short time, a large number of reports about DigiD and the Belastingdienst, the Dutch tax authority, appeared on the outage-tracking site Allestoringen.nl.
The DigiD website itself remained reachable, but a notice at the top of the page said some people could not log in with the DigiD app on Android phones, and its link led to a standard help page about Android login failures. DigiD and DigiD Machtigen, the service people use to authorize someone else to handle government matters on their behalf, were only partially available. The Belastingdienst’s online services were also affected, and users who could not log in were advised to try again later.
Logius confirmed that a DDoS attack caused the disruption and filed a report with the police, a step the spokesperson said the agency always takes after such attacks. The agency said an investigation would be needed to establish who was behind the attack, and it is examining the incident’s cause and consequences, including whether any user data was stolen.
Logius develops and manages DigiD within the Ministry of the Interior and Kingdom Relations, alongside services such as eHerkenning, the business login, and the MijnOverheid citizen portal. Earlier this month, Logius and the Belastingdienst held a joint exercise on protecting their digital services against DDoS attacks, and on Oct. 22 Logius said its own websites were reachable again after it had taken preventive security measures. DigiD’s infrastructure is run by Solvinity, whose acquisition by Kyndryl the Dutch government blocked over security concerns in May and upheld this month.
Sources: ANP via ZeelandNet, Techzine, RTL Nieuws
–
By the ID Tech Editorial Team
