How to stay safer online: passwords, DigiD and smart devices

A cyberattack on Dutch bitcoin broker Bitonic has put online security back in the spotlight, shortly after software flaws prompted precautionary website shutdowns in the Netherlands. From securing your accounts to checking updates for connected devices, what steps can you take to protect your money and personal data?

What happened in the Bitonic cyberattack?

Dutch bitcoin broker Bitonic, a platform for buying and selling bitcoin, disclosed on October 26 that attackers had accessed part of its systems the previous evening. In its official statement, the company said small amounts of bitcoin had been withdrawn without permission from three customers’ accounts. All three customers were fully reimbursed.

The attackers also changed the login details of two accounts. Bitonic said it fixed the vulnerability and restored its systems, but its investigation into the cause and extent of the attack continues. It cannot yet rule out access to other customers’ personal data, although its findings so far suggest this did not happen.

Customers were automatically logged out of the website and app as a precaution, according to NOS. Bitonic’s services are available again, but additional security checks could cause bitcoin withdrawals to take longer than usual.

Why your connected devices need attention too

Online security also extends to the devices connected to your home network. Last week, two security flaws in PHP, a programming language used by many websites and applications, prompted organisations in the Netherlands to temporarily take websites offline. The National Cyber Security Centre (NCSC) warns that PHP is also built into some network equipment and other products, meaning updates may be needed beyond websites.

One example is network-attached storage (NAS), a device used to store and share files, such as photos and documents, over a home or office network. Manufacturers Synology and QNAP have identified affected software in their products. Synology has released updates for affected PHP packages and applications, so owners should check the manufacturer’s security guidance for their particular setup.

The risk needs perspective, however. In its October 23 update, the NCSC said exploiting the flaws was complicated and widespread exploitation was less likely than initially feared. Its advice remains to install the available security updates as soon as possible, including manufacturer updates for affected equipment.

What can you do to improve your online security?

The steps you can take depend on whether you are protecting an account or updating a device. Strong passwords and extra login checks help secure accounts, while software vulnerabilities need security updates from the provider or manufacturer.

Strengthen your account security

Use a different, strong password for each account and store them in a password manager. Enable two-factor authentication wherever possible: this adds a second check when you log in. Bitonic specifically advises customers to use an authenticator app rather than receiving codes by email or text message.

In the Netherlands, this also means protecting your DigiD, which provides access to services such as MijnOverheid and Mijn Belastingdienst. DigiD recommends enabling “Always log in using two steps” (Altijd inloggen in 2 stappen) in Mijn DigiD, using its app or SMS verification. Never share your login details or app PIN. If someone handles government matters on your behalf, use DigiD Machtigen, its official authorisation service, instead of sharing your credentials.

Be cautious of messages asking you to take urgent action after a security incident. Open the service’s official app or website yourself to check your account. Bitonic warns that it never asks customers to share passwords or login codes, or send bitcoin to another address. Contact the company through its official channels if you spot unfamiliar activity.

Check updates for your connected devices

Check the manufacturer’s official app or support website for security updates. Owners of home storage systems should check installed applications too, since affected PHP software may be included in individual packages. If you are unsure, ask the manufacturer whether your model or software is affected and which update you need.

Keeping smart doorbells, baby monitors and other connected devices updated is also good general practice. This does not mean they are all affected by the PHP flaws. Dutch online safety platform Veilig Internetten recommends installing smart-device updates promptly and regularly backing up important files.