Fewer Dutch firms hit by cyber incidents than in 2016

The share of Dutch businesses hit by a cyber incident has more than halved over the past decade, according to figures by the national statistics agency CBS.

In 2024, 4% of businesses experienced at least one cyber incident caused by an external attack – such as IT systems going down after a ransomware attack – compared with 11% in 2016. The data comes from the annual Cybersecurity Monitor, which CBS compiles for the economic affairs ministry.

Incidents are also costing fewer firms money: 1% reported financial damage from an external attack in 2024, down from 6% in 2016.

The fall was seen in both small and large companies compared with 2016. But the rate for firms with 250 or more employees did not drop between 2023 and 2024, remaining at 16% – well above the 4% average. Large firms remain the most frequent targets, even as they invest most heavily in defences.

Sector and size gaps

Cyber incidents were most common at information and communication firms (7%) and least common in hospitality and healthcare (2%) – though a ransomware attack in April that stole patients’ medical data showed the health sector is not immune.

Bigger companies take far more protective measures. In 2025, 86% of firms with at least 250 staff had adopted 10 or more of 12 standard security measures, against just 13% of the smallest firms.

The gap was widest for harder steps such as data encryption, used by 91% of large firms but only 33% of those with 2 to 10 staff.

Just under one in five businesses (19%) carry insurance against cyber incidents, rising to 40% in financial services.