The DDoS wave against banks (2013): 5 lessons on payment services

What happened

From early April 2013, banks were confronted with DDoS attacks: the deliberate overloading of websites and services with enormous volumes of traffic. One bank was the first target and was hit several times in a short period, so that customers could not use their online and mobile banking.

Shortly afterwards other banks followed and iDEAL went down as well, meaning that online payments at web shops temporarily failed. In a DDoS attack there is no break-in and no data is stolen; the aim is disruption. Who was behind the attacks has never become known. Banks and the NCSC subsequently took up the response together.

Lesson 1: Be quick and honest, even without knowing the cause

Customers who cannot make card payments or transfers want to know straight away what is going on. During a DDoS attack it is often not yet clear at the start how long it will last. Do not wait for that: quickly give an honest message that there is a disruption, that you are working on it and what customers can and cannot do.

Be clear that no data has been captured. When there are payment problems, people quickly think of fraud; you must actively take away that concern.

Lesson 2: Communicate on a channel that does not go down too

If your website and app are the target, you cannot rely on them for your communication.

• Use a status page that runs on independent infrastructure, separate from the systems that are under attack.
• Use social media and the press to reach customers who do not visit your own channels.
• Make sure customer service has the same, up-to-date message; nothing is more damaging than contradictory information.
• Offer an alternative where possible, for example by phone or at the branch counter.

Lesson 3: Payment services are chain services

When iDEAL went down, it was not only bank customers who noticed, but also web shops and their customers. Payment is a chain: a problem at one bank or in the shared payment infrastructure affects many parties at once.

So coordinate within the sector and with the payment infrastructure. Consistent communication prevents each link from telling its own story and increasing the unrest.

Lesson 4: Protect trust, because it is your capital

For a bank, trust is the most important asset. An outage of a few hours is annoying; the feeling that the bank is not in control or is not communicating honestly is far more damaging.

So be transparent, show that you take the situation seriously and honour your commitments. Goodwill in cases of demonstrable damage and clear aftercare contribute more to trust than a perfect technical recovery that you do not explain.

Lesson 5: Know your reporting obligations (DORA, NIS2 and CER)

For the financial sector, DORA (Digital Operational Resilience Act) has applied since 2025: you report a serious ICT incident to De Nederlandsche Bank (DNB), with an initial notification, interim updates and a final report. For financial entities, DORA is the specific regime for ICT incidents.

In addition, banks are critical entities under the Critical Entities Resilience Act (CER) for physical and all-hazards resilience; the Cybersecurity Act (NIS2) forms the broader cyber framework. During the crisis, record which reports were made when and to whom.

How CrisisRadar helps

CrisisRadar gives your crisis team a shared picture: management, IT, payment experts, customer service and communications all work with the same information. You record facts, draw up a reassuring customer message and a report for the supervisor within minutes, and publish the status on your own status page that runs separately from your core systems. Reporting-obligation timers keep track of the DORA deadlines.

Would you like to see what a disruption in payment services looks like step by step in the platform? Then take a look at the accompanying practice scenario.

Stappenplan

Veelgestelde vragen

What is a DDoS attack and is data stolen in the process?

A DDoS attack overloads a website or service with an enormous amount of traffic, so that it becomes unavailable. There is no break-in and no data is stolen; the aim is to disrupt availability.

How do you communicate when your own website and app are down?

Use a status page on independent infrastructure, and deploy social media, the press and customer service with the same up-to-date message. In this way you reach customers even when the channels under attack are not working.

Which reporting obligation applies to banks in the event of an ICT incident?

For the financial sector, DORA applies: you report a serious ICT incident to De Nederlandsche Bank (DNB), with an initial notification, interim updates and a final report. Banks are also critical entities under the CER, with NIS2 as the broader cyber framework.