Ticketing-system data exposure incident
DIVD · attacker-operated agent
- What happened
- DIVD, a Dutch volunteer security organisation, disclosed that an attacker broke into its ticketing system on 21 September, gained root access and then used AI agents for the rest of the intrusion. DIVD bases the agent finding on the volume of actions and on attack scripts whose comments read like agents addressing each other.
- Impact
- User email addresses were taken (reported). DIVD found signs of partial data theft from other operational systems and was still assessing the extent.
- What would have caught it
- Monitor unusual cross-service access and data exports after a host is compromised. Keep sensitive services behind independent access checks.
- Sources
- DIVD incident case file (source date 2026-09-29)
- DIVD data investigation (source date 2026-10-09)