Disclosed in 2025, Attempted the Year Before

The Dutch Military Intelligence and Security Service disclosed on 22 April 2025 that Russian actors had attempted to sabotage the digital control system of a Dutch public facility during the preceding year, describing it as the first known cyberattack against Dutch critical infrastructure.

This corpus is built on disclosure, and it has repeatedly recorded delays: 74 days at 25-1027, four months at 25-0710, breached in 2024 and disclosed in 2026 at 26-0515. Each was criticised as a structural failure of notification law.

An intelligence service operates on entirely different logic. Disclosing an attempt reveals what was detected, which reveals detection capability, which is the thing an adversary most wants to know. Holding it is not a compliance failure; it is the point.

So the corpus’s usual criticism does not transfer. It also means the incident record for this category is systematically delayed by years, and nothing in this database corrects for that.

Attempted means it did not succeed, which distinguishes it from every industrial-control file in this corpus and makes it a rare recorded instance of a defence working.

First known means first detected and disclosed. It is not a claim that nothing preceded it — the pre-positioning logic at 25-0522 and 26-0715 describes adversaries whose objective is to remain unnoticed, and the corpus should read "first known" as a statement about detection.

Nothing here was for sale. There was no extortion demand, no data to publish, no monetisation path. The objective was to affect a physical system.

That is the category the Polish grid file at 25-1229 also touches, and it is the one this database is least equipped to record — because it produces no notification, no affected count, and frequently no public acknowledgement until a security service chooses to speak.