What is a cyber incident?
A cyber incident is an event that actually compromises the availability, authenticity, integrity or confidentiality of data or of the services of network and information systems, usually through malicious activity and sometimes through human error or misconfiguration. This wording follows the definition of ‘incident’ in Article 6 of NIS2, which also underpins the Dutch Cybersecurity Act. In an office environment a cyber incident mainly leads to data breaches and system outages; in an OT environment it can also halt production, damage equipment or put people at risk.
🧠 When is an event a cyber incident?
Not every anomaly is an incident. Security professionals distinguish four concepts that recur throughout standards and legislation:
| Concept | Meaning | Example |
|---|---|---|
| Event | Any observable occurrence in a system or network | A failed login attempt in the logs |
| Near miss | An event that could have caused harm but was prevented or did not materialise | A phishing email reported by an employee before anyone clicks |
| Cyber incident | Availability, authenticity, integrity or confidentiality has actually been compromised | An engineering workstation encrypted by ransomware |
| Significant incident | An incident that causes, or is capable of causing, severe operational disruption, financial loss or considerable damage to others | A production site shut down for days |
The distinction matters in practice. An event is assessed in the SOC or OT SOC; an incident triggers your incident response process; a significant incident also triggers the legal reporting obligation. Near misses are not reportable, but you can share them voluntarily with the CSIRT and they are valuable to learn from.
🎯 What types of cyber incidents occur?
| Category | Examples |
|---|---|
| Malware | Infection by Ransomware, Spyware or viruses |
| Unauthorised access | Intrusion via vulnerabilities, stolen credentials or poorly secured VPN connections and remote access |
| Social Engineering | Phishing or fake helpdesk requests leading to system access |
| Misconfiguration | Unprotected open ports, default passwords, incorrect firewall rules |
| DDoS attacks | Overloading websites, systems or networks by external parties |
| Insider misuse | A current or former employee or supplier causing harm, deliberately or not, see Insider Threat |
| Supply chain incidents | An attack through a supplier or maintenance contractor, see Supply Chain Risk |
| OT-specific | Manipulation of SCADA, PLCs or safety systems, sabotage of production lines |
Many incidents combine categories: a phishing email yields credentials, the attacker moves in through remote access and then deploys ransomware. Frameworks such as MITRE ATT&CK for ICS describe such chains step by step.
🏭 What does a cyber incident look like in an OT environment?
In industrial environments the stakes are physical processes, not just data. Typical OT incidents include:
- Manipulated control - a changed setpoint or altered logic in a PLC
- Loss of view - disrupted SCADA connections or unreliable Sensor data, leaving operators blind
- Production downtime caused by IT incidents - Ransomware on office systems, after which the plant stops as a precaution
- Data theft - copies taken from a historian or through a poorly secured remote access entry point
Well-known incidents show how wide the consequences can be:
| Incident | Year | What happened? | Impact on OT |
|---|---|---|---|
| Stuxnet | discovered 2010 | Malware manipulated Siemens PLCs in an Iranian enrichment plant | Physical damage to centrifuges |
| Industroyer | 2016 | Attack on a substation near Kyiv using power-grid protocols | Power cut in part of the city |
| NotPetya | 2017 | Wiper disguised as ransomware, spreading worldwide | Container terminals and factories down for days |
| TRITON | 2017 | Attack on Triconex safety controllers in Saudi Arabia | Plant tripped to a safe state and stopped |
| Colonial Pipeline | 2021 | Ransomware on the IT network | Pipeline shut down for six days as a precaution |
| FrostyGoop | 2024 | Modbus commands sent to a heating utility’s controllers in Lviv | More than 600 apartment buildings without heating for two days |
| Jaguar Land Rover Cyberattack | 2025 | IT systems shut down worldwide | Production halted for about five weeks |
| Poland Energy Cyberattack 2025 | 2025 | Wiper malware and sabotage of control equipment at wind and solar farms | Grid operators lost visibility and control |
In addition, Western agencies report that the state-sponsored group Volt Typhoon is preparing sabotage of critical infrastructure by quietly pre-positioning access. Notably, several major OT incidents, including Colonial Pipeline and Jaguar Land Rover, started in the IT network.
🔁 What is the difference between a cyber incident and a vulnerability?
| Vulnerability | Cyber incident |
|---|---|
| A potential weakness | An actual event or attack |
| Found through Vulnerability Management or vulnerability scanning | Must be detected, contained, reported and analysed |
| Response: patch, mitigate or accept the risk | Response: incident response and recovery |
| Preventive | Reactive, but often leads to preventive actions |
A vulnerability becomes an incident as soon as someone exploits it. That is why actively exploited vulnerabilities take priority in patch management.
🔐 What should you do during a cyber incident?
Two references dominate. NIST SP 800-61 Revision 3, published in April 2025, replaces the 2012 edition: it drops the four-phase life cycle (preparation; detection and analysis; containment, eradication and recovery; post-incident activity) and maps incident handling onto the functions of NIST CSF 2.0. The international standard ISO/IEC 27035-1:2023 describes a similar approach: prepare, detect, report, assess, respond and learn. In practice it comes down to six steps:
- Detection - through SIEM, network monitoring or a report from an operator
- Assessment - determine impact, classification and whether the incident is significant
- Containment - isolate affected systems; in OT only in consultation with the process owner
- Reporting - to the CSIRT and the supervisory authority, and where necessary to the Dutch Data Protection Authority
- Recovery - restore systems via Disaster Recovery and Business Continuity, preferably from an immutable backup
- Evaluation - root cause analysis and improvement actions, recorded in a lessons-learned report
Document these steps in advance in an incident response plan and rehearse them in a tabletop exercise. Preserving evidence belongs to every step: forensic investigation is difficult once systems have been reinstalled.
🧯 How does incident handling in OT differ from IT?
An IT reflex such as “pull the plug” can be dangerous in a plant. Key differences:
- Safety comes first - an abruptly stopped process can itself create a hazardous situation; the SIS and process safety set the limits for containment
- Availability over confidentiality - the priority is keeping the process running or stopping it in a controlled way
- Limited forensic options - PLCs and HMIs keep little logging, so compare programs against a known-good version
- Vendors are needed - restoring controllers often requires the system integrator or the manufacturer
- Manual fallback - operators must be able to run the process locally when SCADA cannot be trusted
Standards address this: IEC 62443-2-1 requires incident handling as part of the asset owner’s security programme, and NIST SP 800-82 provides OT-specific guidance.
🇪🇺 Which reporting obligations apply in the Netherlands and the EU?
A single cyber incident can trigger several reporting obligations at once:
| Regulation | Who | What to report | To whom | Deadline |
|---|---|---|---|---|
| Cybersecurity Act (since 15 August 2026) | Essential and important entities | Significant incident | CSIRT and supervisory authority via MijnNCSC | 24 hours / 72 hours / 1 month |
| AVG (GDPR) | Every data controller | Personal data breach | Dutch Data Protection Authority | 72 hours |
| Cyber Resilience Act (since 11 September 2026) | Manufacturers of products with digital elements | Actively exploited vulnerability or severe incident | Coordinating CSIRT and ENISA via the Single Reporting Platform | 24 hours / 72 hours / final report (14 days after a fix, or 1 month) |
For most sectors the NCSC is the CSIRT; for the water boards it is CERT-WM. The NCSC is not a supervisory authority: supervision lies per sector with bodies such as the RDI and the ILT. Government bodies also follow the BIO, and organisations certified to ISO 27001 organise incident management with Annex A controls 5.24 to 5.28 and 6.8. Details per deadline are in Cybersecurity Act Incident Reporting and CRA Reporting Obligations.
❓ Frequently asked questions
What is the difference between a cyber incident and a cyberattack?
A cyberattack is a deliberate attempt to compromise systems. A cyber incident is broader: it also covers disruptions caused by human error or misconfiguration, and it only counts as an incident once availability, integrity, authenticity or confidentiality has actually been compromised.
Do I have to report every cyber incident?
No, under the Dutch Cybersecurity Act only a significant cyber incident must be reported, meaning one that causes, or is capable of causing, severe operational disruption, financial loss or considerable damage to others. A personal data breach must additionally be reported under the GDPR to the Dutch Data Protection Authority, unless it is unlikely to pose a risk to the people concerned.
Is an outage caused by human error also a cyber incident?
Yes, a cyber incident does not have to be malicious. A misconfigured firewall rule or a failed update that takes down a control network compromises availability and is handled through the same incident process.
What is a near miss?
A near miss is an event that could have compromised data or services but was prevented in time or did not materialise. NIS2 defines the term separately; near misses are not reportable but can be shared voluntarily with the CSIRT.
How quickly must an organisation respond to a cyber incident?
Under the Dutch Cybersecurity Act an early warning is due within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours and a final report within one month. Technically, the faster detection and containment happen, the smaller the damage, so a rehearsed incident response plan is essential.
Why does an IT incident so often stop the factory?
Production depends on IT systems such as ERP, MES and scheduling software, and after a ransomware attack companies are often unsure whether the OT environment is clean. They therefore stop as a precaution, as Colonial Pipeline in 2021 and Jaguar Land Rover in 2025 demonstrated.
📌 In summary
A cyber incident is a security event that actually compromises the availability, integrity, authenticity or confidentiality of IT or OT systems, threatening continuity or safety. A rapid, coordinated and rehearsed response limits the damage and helps you meet reporting obligations under NIS2, the Cybersecurity Act, the GDPR and ISO 27001.