Europe went partly offline without one confirmed hack

On Wednesday 21 October 2026, DigiD, MijnOverheid and Overheid.nl went dark. Not because hackers had broken in. The Dutch National Cyber Security Centre (NCSC) had not yet seen any active abuse, and still governments, municipalities and companies pulled the plug themselves. Europe went partly offline this week without a single confirmed hack, and that says more about how exposed we are than many real attacks do.

One flaw in PHP took sites down in four countries

PHP is the programming language behind roughly 69 percent of websites whose language is known, according to W3Techs. On 20 October its developers announced two serious flaws that let an attacker run code on a server remotely, without logging in. According to Reuters, governments in the Netherlands, Denmark, France and Finland then took websites offline. Schiphol acted too: current flight information disappeared from the Schiphol app.

The fix arrived on 21 October at 16:00. VRT reports that it only exists for PHP version 8.2 and later. Anyone running an older version has to upgrade first. We covered the flaw itself in PHP flaw takes government sites offline. Here the question is a different one: why did so many organisations lock their doors before anyone had knocked?

What does that mean? A vulnerability is a mistake in software that lets someone get in. A cyberattack is the moment someone actually does it, to steal data, hold systems for ransom or knock a service offline. On 21 October it was mostly about the first. Organisations locked the door before anyone could walk through it.

The clock starts ticking once a flaw is public

A public flaw works like a manual. According to Reuters, experts expected a wave of intrusions, because AI tools can rebuild the bug with little effort once the fix is out. The same report says the flaws had been sitting in the software for years and only surfaced with the help of AI.

Every administrator then makes the same trade. A few hours visibly offline, or the risk that someone slips in unnoticed and stays. For DigiD, the government chose offline. But what if the attack does not hit your system, but your supplier's?

Attackers go after the supplier everyone shares

On 20 September 2025 it really did go wrong. A cyberattack hit an outside IT provider of the check in and boarding systems at several European airports, NOS reported. At Brussels Airport at least nine flights were cancelled and fifteen were delayed by an hour or more. Staff had to check passengers in by hand.

Schiphol escaped that time. The pattern is clear, though. The weak spot is rarely the airport itself, but the software that many airports use at once. PHP works the same way: one language under millions of sites. The targets with the biggest impact are the systems everyone leans on: government logins, travel and payments.

An outage and an attack feel exactly the same

On Sunday 18 October 2026, all 78 electronic passport gates at Schiphol stopped working from 06.00. The Royal Netherlands Marechaussee had to check travellers by hand. According to a Schiphol spokesperson, several hundred people missed their flight. It turned out to be an IT fault and not a cyberattack, the Marechaussee said.

For the people in the queue, that made no difference. The flight was gone. And that is the lesson for your money: the question is not only whether someone can steal your savings, but whether you can reach them when you need them.

Your money stays put, but you may not reach it for a while

Your balance does not vanish when a website goes down. Your bitcoin sits on a blockchain, not on your platform's website. But the app you use to log in, buy or sell runs on ordinary servers. If that app goes down, you own something you temporarily cannot touch.

Small business owners felt that straight away this week. Hosting company Mijndomein, which as a provider has an interest in showing it acted fast, took all customer websites offline at 14:30 on 21 October. From 18:05 they came back step by step, and only at 11:20 on 22 October did it report the outage as resolved. For a web shop, those are hours without sales.

In numbers: Say you have 2,500 euros in your current account, 4,000 euros on a crypto platform and no cash at home. On paper you own 6,500 euros. If you cannot use your card or log in for a day, the money you can actually spend that day is 0 euros. Keep 100 euros in cash at home, and that is your whole budget for groceries and fuel that day.

Every big flaw is followed by fake emails

Big outages make perfect bait. An email asking you to "restore your DigiD" or "secure your wallet after the PHP flaw" sounds believable this week. That is exactly what makes it dangerous. The most common tricks are in How to spot crypto scams before you pay.

Watch out: No bank, government body or crypto platform will ever ask for your recovery phrase, the string of words that gives access to your crypto. Anyone asking for it after an outage is a scammer. Always log in through the app or an address you type yourself, never through a link in an email or text message.

A day without internet needs preparation on paper

Preparing costs little. It is about access, not returns. A few things you can sort out yourself:

Keep some cash at home. The National Forum on the Payment System, in which De Nederlandsche Bank and banks work together, has advised households to do so for some time.
Build an emergency fund in an ordinary savings account before you invest, see Emergency fund.
Have a second way to pay, for example a card from another bank.
Keep your recovery phrase offline, see Hardware wallet.
Write down on paper which accounts, investments and insurance policies you have, with the phone numbers.

Tip: Put your phone in airplane mode for one evening and walk through it. How would you pay for groceries tomorrow? Which number do you call to reach your bank? And do you know, without searching, where your recovery phrase is?

The Netherlands and Belgium each have their own alarm desk

In the Netherlands the NCSC issues warnings, in Belgium the Centre for Cybersecurity Belgium (CCB). On 21 October the CCB had not yet seen attacks in Belgium, according to VRT, and the NCSC saw no active abuse in the Netherlands that day. Tech companies, on the other hand, told Reuters that some hackers were already exploiting the flaws. How much damage this does in the end is still open.

If you want to know whether an outage is real, check the NCSC website or Safeonweb, the CCB website, rather than a link someone sends you. Website administrators meanwhile have to install the update. If they do not, the hole stays open.

Questions to ask

How many days can my household manage if card payments and online banking fail?
Can I reach my crypto if the platform I trade on is offline for a day?
Do I know where my recovery phrase is, and does nobody else?
Do I have a second way to pay, at another bank?
How do I check whether an email about an outage really comes from the sender?

This article is an explanation, not financial advice.

Market calendar

Never miss an important moment again

What do you want to follow?

Your calendar

Important news

Europe went partly offline without one confirmed hack

In short

One flaw in PHP took sites down in four countries

The clock starts ticking once a flaw is public

Attackers go after the supplier everyone shares

An outage and an attack feel exactly the same

Your money stays put, but you may not reach it for a while

Every big flaw is followed by fake emails

A day without internet needs preparation on paper

The Netherlands and Belgium each have their own alarm desk

Questions to ask

Sources

The best explainers in your inbox every week

Also read

Tesla and Nvidia target AI chip bottlenecks with $2.8B

PHP flaw takes government websites offline

Why is Ursula bringing Gates into Europe’s AI debate?

Always wanted to learn investing? Or ready for real expertise? Take our free course.