Ịwakpo na mpụ ịntanetị na Netherlands: ihe iwu machibidoro

Hacking is a criminal offence in the Netherlands: under Article 138ab of the Dutch Criminal Code (Sr), intentionally and unlawfully entering a computer system is computer trespass, punishable by up to two years’ imprisonment even if nothing is copied or damaged. The exception is access with permission: a penetration test within a written assignment is not unlawful, but Dutch law has no general exemption for well-intentioned “ethical” hackers.

Related offences cover denial-of-service attacks (Article 138b Sr), interception (Articles 139c to 139e Sr) and damaging data, including ransomware (Articles 350a to 350d Sr). Separately, the Cybersecurity Act (Cyberbeveiligingswet), in force since 15 August 2026, places security and reporting duties on organisations.

Which hacking offences does the Criminal Code define?

Cybercrime is not a separate statute but a set of offences in the Criminal Code. The maximum penalties below are set by the law; the court decides the actual sentence.

Computer trespass (Article 138ab Sr)

Computer trespass (computervredebreuk) is intentionally and unlawfully entering an automated system or part of it. Entry exists in any case if access is gained by breaking a security measure, by a technical intervention, with false signals or a false key, or by assuming a false identity. The maximum is two years’ imprisonment or a fourth-category fine.

The maximum rises to four years if the intruder then copies, intercepts or records data from the system (Article 138ab(2) Sr). The same applies if the intrusion runs through a public telecommunications network and the intruder uses the system’s processing capacity for unlawful gain, or moves on to a third party’s system. If the offence is committed for a foreign power, the maximum is increased by one third.

Obstructing a system (Article 138b Sr)

Denial-of-service attacks fall under Article 138b Sr: intentionally and unlawfully obstructing access to or use of a system by sending data to it. The maximum is two years, three years if a botnet is used or the aim is unlawful gain, and five years if the attack causes serious damage or targets vital infrastructure.

Interception and hacking tools (Articles 139c to 139e Sr)

Article 139c Sr prohibits intentionally and unlawfully intercepting or recording data not intended for you with a technical device, with a maximum of two years. There are exceptions, for example for the holder of the connection (unless clearly abusive) and for criminal investigations or the Intelligence and Security Services Act 2017.

Article 139d Sr punishes preparation: making, selling or possessing tools designed mainly for hacking, interception or denial-of-service attacks, or passwords and access codes, with the intent of committing such an offence. The maximum is two years, or four years if the intent concerns the aggravated forms of computer trespass. Article 139e Sr punishes possessing or disclosing unlawfully intercepted data, with a maximum of six months.

Damaging data and ransomware (Articles 350a to 350d Sr)

Article 350a Sr punishes intentionally and unlawfully altering, deleting or making data inaccessible, with a maximum of two years; the aggravations of Article 138b Sr apply, so ransomware aimed at unlawful gain carries up to three years and serious damage up to five. Distributing malware carries up to four years, unless the aim was to limit the damage it causes.

Article 350b Sr is the negligent variant, with a maximum of one month if serious damage results. Article 350c Sr covers intentionally destroying or disrupting a system, and Article 350d Sr covers preparatory acts with tools or access codes.

Where is the line between security research and computer trespass?

Testing someone else’s system is lawful because it is authorised, not because it is well intended. Under Article 138ab Sr consent removes the unlawfulness only as far as the consent reaches.

A penetration test therefore needs a written assignment stating the systems in scope, the period, the permitted and excluded techniques, how encountered data is handled and who is informed. If the systems are hosted by a third party, that provider must also agree, because the client cannot consent on its behalf.

Outside a commissioned test, many organisations publish a coordinated vulnerability disclosure policy. Such a policy does not create immunity: the Public Prosecution Service (Openbaar Ministerie) still decides whether to prosecute. Relevant factors are whether the finder acted in the public interest, went no further than necessary, did not copy or publish data and reported promptly to the organisation.

Employees and former employees are not exempt. Access rights end when the role ends; logging in with an old account or a colleague’s password is entry with a false key under Article 138ab Sr.

Which offences apply to online fraud?

Most digital cases reported to the police are fraud committed by digital means. Phishing, invoice fraud and fake webshops fall under fraud (oplichting) in Article 326 Sr, with a maximum of four years. Using another person’s identifying personal data to conceal or misuse an identity is a separate offence under Article 231b Sr, with a maximum of five years.

Moving the proceeds through bank accounts or crypto-assets brings in the money-laundering offences of Articles 420bis to 420quater Sr; intentional laundering carries up to six years. This is why people who lend out their bank account (money mules) are prosecuted as well. Publishing someone’s personal data to intimidate them (doxing) is a separate offence under Article 285d Sr, with a maximum of two years. How digital deception is proved is explained in our article on wayo na phishing n'ịntanetị.

What does the Cybersecurity Act require of organisations?

The Cybersecurity Act implements the EU NIS2 Directive and has applied since 15 August 2026. It does not punish attackers but places duties on essential and important entities: providing their details for the national register, taking appropriate security measures and reporting significant incidents.

An entity must give an early warning to its CSIRT and its competent authority without undue delay and in any case within 24 hours of becoming aware of a significant incident (Article 26 Cybersecurity Act). A fuller notification follows within 72 hours (Article 27). Which organisations are covered is explained in our article on NIS2 na Iwu Nchekwa Ntanetị Dutch.

These duties apply alongside the GDPR. An incident involving personal data is a personal data breach that must be reported without undue delay to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), unless it is unlikely to pose a risk to the individuals concerned. The civil side is discussed in our article on ibu ọrụ mgbe mmebi data gasịrị.

Which investigative powers do the police have?

Since the Computer Crime Act III (Wet computercriminaliteit III) entered into force in 2019, the police can remotely enter a computer system used by a suspect, for serious offences. Under Article 126nba of the Dutch Code of Criminal Procedure (Sv) the public prosecutor may order this only after written authorisation by the examining magistrate (rechter-commissaris).

The public prosecutor can order a person who is believed to know how data is encrypted to help decrypt it, but under Article 126nh(2) Sv that order cannot be given to the suspect. As a suspect you keep the right to remain silent and the right to consult a lawyer before and during police questioning.

Because attacker and victim are often in different countries, international cooperation matters. The Netherlands is a party to the Council of Europe Convention on Cybercrime (Budapest Convention), uses the European Investigation Order within the EU and works with Europol, Eurojust and Interpol.

What can you do as a victim?

File a police report (aangifte) as the basis for an investigation; our ntuziaka maka itinye akụkọ ndị uwe ojii explains how. Preserve evidence before systems are reinstalled, and contact your bank immediately if payments were diverted, because a fast recall request is often the only chance to recover money.

You can join the criminal proceedings as an injured party (benadeelde partij) and claim damages there, provided the claim does not unduly burden the criminal case. Larger or disputed claims go to the civil court as an unlawful act under Article 6:162 of the Dutch Civil Code (BW). Summary proceedings (kort geding) can be used to have material taken offline quickly. The first steps are set out in our article for ndị a na-awakpo n'ịntanetị.

What should you check as an organisation that was attacked?

• Check whether you are an essential or important entity under the Cybersecurity Act and diarise the 24-hour and 72-hour reporting deadlines.
• Check whether personal data was involved and whether the breach must be reported to the Autoriteit Persoonsgegevens.
• Secure log files, affected systems, e-mail headers and a timeline before restoring systems.
• Ask your bank to recall diverted payments on the same day.
• File a police report and record which suppliers or service providers were involved.

What should you check as a suspect or security researcher?

• Check whether you had written permission covering the exact systems, period and techniques used.
• Check whether a hosting provider or other third party also had to consent.
• Do not give a statement to the police before consulting a lawyer.
• Do not delete data or devices after you learn of an investigation.
• Check whether the vulnerability was reported promptly and without conditions under the organisation’s disclosure policy.

What can we do for you with cybercrime and hacking?

Anyị ndị ọka iwu cybercrime act for organisations that have been attacked and for individuals and companies under investigation.

• We assess whether conduct falls under Articles 138ab, 138b, 139c or 350a Sr.
• We assist you during police questioning and throughout the criminal investigation.
• We check your reporting duties under the Cybersecurity Act and the GDPR within the first 24 hours.
• We draft the police report and the claim as an injured party.
• We start summary proceedings to have stolen or published data taken offline.
• We review penetration-test assignments and vulnerability disclosure policies before work starts.

Summary

• Entering a computer system without permission is computer trespass under Article 138ab Sr, with up to two years, or four if data is copied.
• Denial-of-service attacks, interception, hacking tools and ransomware are separate offences in Articles 138b, 139c-139e and 350a-350d Sr.
• Ethical hacking is only lawful within written permission; a disclosure policy gives no immunity.
• Under the Cybersecurity Act, significant incidents require an early warning within 24 hours and a notification within 72 hours.

Ọtụtụ mgbe Ẹbụp Ajụjụ