Cyber security / Europe and international communications
Dutch services warn of Signal and WhatsApp account compromise
Dutch intelligence services warned on 9 March of a Russian campaign to gain access to Signal and WhatsApp accounts.
- Review cut-off
- Review window
- 2026-03-05 to 2026-03-09
- Published by Caracal Intelligence
Historical review. Published after the period covered. The cut-off is the end of the review date in UTC. We compare source dates and known updates with this cut-off. Some sources lack exact times or earlier versions. Business effects below are possible outcomes, not confirmed losses.
Reported event · 2026-03-09
What happened
Dutch intelligence services warned on 9 March of a Russian campaign to gain access to Signal and WhatsApp accounts. The advisory described phishing against officials and other persons of interest.
Evidence: [1]
Caracal analysis / Possible effects
Global logistics
Compromised messaging accounts could expose voyage plans, staff locations, or emergency contacts. A forged message could also change a collection instruction or disrupt coordination with a supplier.
Trade and supply chains
Commercial teams could face impersonation and disclosure risks when they use personal messaging accounts for sensitive business. The advisory did not establish compromise of every user or the messaging platforms themselves.
Industries to watch
Defence, shipping, project logistics, and firms working in sensitive regions should review how staff share operational instructions.
- Defence
- Shipping
- Professional services
What to check next
- Verify sensitive changes through a separate channel.
- Review linked devices and account recovery controls.
Sources and evidence limits
[1] AIVD and MIVD · Official security advisory · Published 2026-03-09
Dutch services warn of Signal and WhatsApp account compromise — source report
The report identifies a campaign and known targets. It does not prove that a particular company's account was affected.
Sources and claims checked on . This check compares the brief with dated source reports. It does not independently confirm every reported incident. Check current conditions before you change an operating plan.