Dutch cybercrime landscape shifts: from deepfake porn to extortion of grocery customers and forged TLS certs

The Netherlands is facing a rapidly diversifying cybercrime threat, as a single week’s developments show: a 74-year-old man is being prosecuted for creating deepfake pornography of dozens of public figures, a grocery delivery startup’s customers are being individually extorted after a data breach, and attackers have obtained counterfeit TLS certificates for Google by compromising three country-code top-level domains. Meanwhile, a police report warns that a new generation of Western cybercriminals – aged 11 to 25 – is behind much of this activity.

Deepfake prosecution sets a precedent

The Dutch Public Prosecution Service (OM) confirmed on 20 September that it will prosecute a 74-year-old man from North Holland for making and distributing deepfake pornography of dozens of well-known Dutch women, including politicians, Olympic athletes, TV presenters and members of the royal family. The videos were hosted on a platform that drew 13 million monthly visitors, which has since been taken offline. The suspect faces up to two years in prison. The OM said it will not seek extradition of the Canadian who ran the site, because what he did was not illegal in Canada and pursuing him would require too much police capacity Source 3.

Flink breach: hackers turn to individual extortion

In a tactic that security researchers say is unusual, the LPG Group – a previously unknown hacker collective – stole the data of 1 million customers and over 10,000 employees of grocery delivery service Flink. The data includes home addresses, phone numbers and order histories from March to September 2026. After Flink refused to pay a ransom of 235,000 euros, the hackers began contacting individual customers and employees, demanding 10–15 euros in cryptocurrency to keep their data private. When few paid, the group put the entire dataset up for sale on the dark web. RTL verified the authenticity of the data with affected customers Source 5.

Pim Takkenberg of security firm Northwave told NOS that while ransomware groups have previously targeted universities through hacked software platforms, directly extorting individual consumers is a new development Source 4.

A new generation of cybercriminals

The police and OM’s annual Cybercrimebeeld report, published earlier in September, highlights the rise of a new cohort of Western cybercriminals aged 11 to 25. They meet in loose online networks, are motivated by money and status rather than ideology, and specialize in data theft and cryptocurrency heists. The report cites the ShinyHunters group – which hacked telecom provider Odido earlier this year, stealing data of 6 million customers – as a prime example. Police say Dutch nationals were likely involved Source 1.

Flock Safety camera physically hacked

In a separate incident, hackers physically removed a Flock Safety automatic license plate reader from a roadway, copied its storage and recovered an on-device encryption key. They shared the data with 404 Media and WIRED, revealing that the camera’s software explicitly detects people, bicycles and bumper stickers – not just license plates – and captured 1.6 million images over several weeks. The hackers published details of the exploit, hoping others will replicate it Source 2.

Counterfeit TLS certificates for Google

Last week, Ars Technica reported that attackers compromised three country-code top-level domains (ccTLDs) to obtain counterfeit TLS certificates for Google and other large services. By controlling the ccTLDs, they changed DNS records to pass domain validation checks. Google said it has blocked the known unauthorized certificates in Chrome, but warned that browser-side interventions cannot be relied upon to protect all users, and that undiscovered certificates may remain a threat. The incident echoes the 2011 DigiNotar breach, in which a Dutch certificate authority was hacked Source 6.

What this means for engineers

For technically literate readers, these cases illustrate several systemic weaknesses: the reliance on domain validation for TLS certificates remains fragile when ccTLDs are compromised; on-device encryption keys stored alongside ciphertext are not real protection; and the shift toward individual extortion suggests attackers are adapting to corporate non-payment. The Dutch police’s focus on young, Western offenders implies that law enforcement is beginning to treat cybercrime as a domestic recruitment problem, not just an external threat.

Security teams should review their certificate issuance processes, ensure that encryption keys are stored in hardware security modules where possible, and prepare for the possibility that attackers may bypass corporate targets and go after end users directly.