When to call the Police when you're hacked

Do first you call the police when you're hacked, or a lawyer?

In this episode of Threat Talks, host Lieuwe Jan Koning sits down with Stan Duijf, Head of Operations at the NIS (National Investigations Special Operations) of the Dutch National Police, to break down what actually happens after a data breach. Stan reveals that only 20% of the 150+ reported Dutch data breaches each year ever reach the police, and explains why that gap puts both companies and their customers at risk.

They cover when a breach is serious enough to call the police, why paying a ransom never makes your data safe again, and what belongs in your incident response playbook before you ever need it.

(00:00) - Cold open: when do you call the police after a hack

(00:40) - Meet Stan Duijf, Head of Operations at the NIS

(02:03) - The real scale of data breaches in the Netherlands

(10:19) - Intrusion vs exfiltration: when the police actually opens a case

(14:42) - Why informing victims late leaves them exposed to scams

(20:39) - Should you ever pay the ransom

(27:01) - Build your playbook: who to call before you're hacked

4. Key Topics Covered

When a data breach is serious enough to involve the Dutch police, and why company size is not the deciding factor.What early, confidential police involvement makes possible, from tracing stolen bitcoin to joining ransom negotiations.The three reasons the Dutch police advise never to pay a ransom.Why informing breach victims late exposes them to scams, and what to decide in your breach playbook in advance.How jurisdiction works for multinational breaches, and how private citizens should report sophisticated phishing.5. Related ON2IT Content & Referenced Resources