True stories
It happened to them too. Read how, and what it cost.
From a fake IT colleague to a backup in the same building as the fire. Every story really happened, summarised in our own words, with the link to the original source. We don't name names: it's about the lesson, not about who had the bad luck.
Phishing and fraud
One click, one call, one payment
Fake e-mails, fake colleagues, a fake bank on the phone and even a fake director on a video call.
2026
A fake IT colleague calls customer service
Customer service staff at a large Dutch telecoms provider, and millions of customers
Cost: Data from 6.2 million customer accounts, including IBANs and ID document numbers. The company refused to pay a ransom and the data was published.
2024
The finance director on the video call was fake
A finance employee at the Hong Kong office of an international engineering firm
Cost: Some 200 million Hong Kong dollars, about 25.6 million US dollars.
2025
'This is your bank's fraud department'
Thousands of Dutch bank customers
Cost: In the Netherlands in 2025, 25.8 million euros from just under 5,900 victims. Just over 45 per cent was reimbursed as a goodwill gesture.
2019
A phishing e-mail in October, a university down at Christmas
A Dutch university
Cost: A ransom of 30 bitcoin, almost 200,000 euros at the time. Dozens of staff worked through the Christmas holidays.
2024
'Hi mum, this is my new number'
Dutch people, often parents, who get a message from 'someone they know'
Cost: Of the Dutch people who fell victim to phishing in 2024, 9 per cent were victims of this friend-in-need fraud. No total amount is known.
2022
Prompt after prompt, until someone pressed Approve
A contractor working for a large US ride-hailing company
Cost: No amount published. But the attacker got into tools including Slack, G Suite and an internal invoice system, and posted a message in a company-wide Slack channel.
2024
First hundreds of spam e-mails, then 'the helpdesk' calls
Staff at various organisations (not named)
Cost: Microsoft gives no amount. Once in, the attackers installed more tools and in several cases spread ransomware across the whole network.
2024
A Teams invitation with a code, on the real Microsoft site
Staff at governments, NGOs, IT firms and other organisations in Europe and beyond
Cost: No amount published. The attackers searched mailboxes for words such as 'password' and 'admin', took e-mails and sent new phishing to colleagues from the hijacked account.
2024
Fake invitations that turned up in your calendar by themselves
Staff at around 300 organisations (not named)
Cost: More than 4,000 of these e-mails in four weeks, at around 300 organisations. Criminals can use the details for credit card fraud; no damage figure has been published.
2023
The hotel's account hijacked, the guests scammed
Hotels that take bookings through a large booking platform, and their guests
Cost: In Singapore at least 30 guests lost 41,000 dollars between them. Dutch travellers lost money and card details too.
2023
A call to the helpdesk: 'I can't log in'
The IT helpdesk of a large US casino and hotel group, and that of a cleaning-products maker
Cost: The casino group reported a negative impact of about 100 million dollars on its results. The manufacturer is claiming 380 million dollars in damages in its lawsuit.
2020
130,000 text messages in a few days
Tens of thousands of recipients in the Netherlands
Cost: According to the Dutch Public Prosecution Service, 60,000 victims of attempted fraud. The man was sentenced to 4.5 years in prison.
2018
A fake MijnOverheid e-mail, and the text code with it
203 Dutch DigiD users
Cost: 203 DigiD accounts were deleted and personal data was probably collected. In the second wave, according to DutchNews, 361 people fell for it.
2019
'Scan this QR code to receive your money'
People selling things on an online marketplace
Cost: Several hundred reports; in some cases fraudsters got away with thousands of euros. The bank refused at first, but later reimbursed all the damage after all.
2024
Fake QR stickers on parking meters
Drivers in Dutch and Belgian cities
Cost: No total known. Anyone who paid handed card or bank details to fraudsters.
2025
'Your SIM card is expiring', and your number belongs to someone else
Customers of two large Dutch providers
Cost: No numbers or amounts known. With the hijacked SIM cards, the criminals sent fake texts in bulk to new victims, from the victim's own number.
2024
'The police' come to collect your jewellery
A 77-year-old woman in Eindhoven
Cost: By the end of October 2025 the Dutch police had registered more than 10,000 incidents with fake police officers, against 520 in the whole of 2023. The criminals mainly target people aged 70 and over.
2023
Her grandson's voice, cloned with AI
Grandparents aged 73 and 75 in Canada, and the parents of a man in Canada
Cost: The grandparents were warned in time by a bank manager. The other family lost 21,000 Canadian dollars. In research for the Dutch government (2024) only 4 per cent could tell for sure that the cloned voice of a well-known radio presenter was fake.
2025
The prime minister recommends an investment. Except it wasn't him.
Facebook users in the Netherlands
Cost: Victims can lose thousands of euros in a short time. In 2025 investment fraud caused the highest damage to private persons of all types of fraud reported to the Dutch Fraud Helpdesk, 34.1 million euros.
Money and books
Paid to the wrong people
A new account number, a secret takeover and an update to bookkeeping software.
2019
'Our new payment route', from a hacked mailbox
The accounts payable team of a large Dutch online shop, and a regular supplier
Cost: 751,493 euros went to the fraudsters. The court ruled that the shop had to pay the supplier again.
2018
A secret takeover in Dubai, paid in six instalments
The managing director and finance director of a Dutch cinema chain
Cost: More than 19.2 million euros. Both directors lost their jobs.
2017
An update to tax software takes down firms worldwide
Users of a Ukrainian tax and accounting program, and through them large companies around the world
Cost: According to the White House, more than 10 billion dollars of damage in total. The shipping company alone lost 250 to 300 million dollars.
Backups and ransomware
There was a backup. Or so they thought.
On the same server, in the same building, with the same password. And twice a happy ending.
2017
The backup was on the same server
A small Dutch bookkeeping office
Cost: Three bitcoin in ransom (2,890.83 euros), one week without any work and another with hardly any. The total claim was over 42,000 euros; the court split the blame.
2023
158 years old, and gone after one attack
A British family-run haulage firm with around 400 lorries
Cost: Without financial records the bank wouldn't lend. The firm went into administration in September 2023 and around 700 people lost their jobs.
2020
Two disks in rotation, and the criminals got nothing
A small Dutch office that handles clients' post and paperwork
Cost: No ransom. The business was at a standstill for one day while everything was put right.
1998
90 per cent of an animated film deleted, and the backup didn't work
A major animation studio, in the middle of making a feature film
Cost: A week of work on an unreliable restore was wasted, and 10 to 12 people worked non-stop for a whole weekend to check everything.
2017
A database wiped, and the backups turned out empty
An online platform for software developers
Cost: Down for about 18 hours. More than six hours of changes were lost, affecting roughly 5,000 projects, 5,000 comments and 700 new user accounts.
2021
Fire at the data centre, and the backup was in the same building
Customers of a large European hosting provider, including small French companies
Cost: 14,046 servers destroyed. Neither company could get its backup back. The software company was awarded 153,837 euros by the court at first instance.
2020
'Welkom2020', and every backup deleted
A Dutch municipality
Cost: Total costs of around 4.2 million euros, and almost two years of recovery work.
2019
The backup drives encrypted too: the practice closes
A small US medical practice
Cost: The practice closed for good on 17 December 2019. 5,835 patients were affected.
2021
Ransom paid, and absolutely nothing happened
A Dutch fashion shop with a web shop and around twenty staff
Cost: About 500 euros of ransom for nothing, weeks of recovery work and 30 to 40 per cent of the data never recovered.
Home office and network
It started at home
A media server, a gaming laptop, a browser profile and routers secretly working for someone else.
2022
A media server on a home PC opened the company vault
A senior engineer at a company that makes a password manager
Cost: A backup of all customer vault data was copied. The UK privacy regulator imposed a fine of 1.2 million pounds.
2023
A Minecraft mod that steals passwords
Players of a popular game, often children, and everyone who uses the same computer
Cost: According to Kaspersky, more than 132,000 young gamers were targeted in one year by malware disguised as games, mods and cheats. No damage figure is known.
2024
One laptop for work, games and pirated downloads
About 165 organisations that stored data on one cloud platform
Cost: About 165 organisations were warned. One of the attackers later admitted stealing, among other things, the call records of more than 100 million customers of a telecoms company; the group received over 2.5 million dollars in ransom.
2023
A work password in a personal browser profile
An employee of a company that handles logins for other businesses
Cost: Files belonging to 134 customers were accessed, and active sessions of 5 customers were hijacked.
2016
Routers and cameras with the factory password
Owners of home routers, cameras and video recorders, and over 900,000 customers of a German provider
Cost: Attacks of more than 1 terabit per second, and over 900,000 households offline.
2024
Old routers secretly working for someone else
Owners of ordinary home and small-office routers, in the Netherlands too
Cost: The NCSC spotted about 150 routers in the Netherlands believed to be compromised, part of around 13,000 compromised systems worldwide. The owners' connections were used for attacks on others.
How we work
How we pick the stories
- Only with a source: a court, the government, the police, a regulator, news media or the company that was hit.
- No guesswork: amounts and numbers are taken exactly as the source gives them. If there's no amount, we say so.
- No names: our summary is about what happened, not who it happened to.
- Stays put: if a source disappears, our summary stays, with the date we checked it.
Press play
Rather not have your own story on this page?
A security check costs you a morning. We look at your e-mail, your backups, your network and how you check payments.