AP warns AI is intensifying phishing and data breach risks as account takeovers rise sharply and cybercriminals use stolen information to create increasingly convincing attacks.
The Autoriteit Persoonsgegevens (AP) 2025 data breach report warns that artificial intelligence is making cyberattacks more sophisticated and increasing the risks of phishing, account takeovers and further data breaches. The Dutch data protection authority recorded 39,407 breach notifications in 2025, up from 37,839 in 2024, with cyberattacks responsible for 2,428 reported incidents. The findings show that AI is not replacing established cyber threats, but making them faster, more convincing and easier to scale.
The AP recorded more than 39,000 data breach notifications during 2025.
The overall number of reported data breaches rose by around four per cent between 2024 and 2025. Although the headline total captures incidents caused by many different factors, the AP highlights cybercrime as a particularly serious source of harm because attacks can expose large volumes of personal data and create continuing risks for affected individuals.
The 2,428 cyberattack-related notifications represent only part of the total number of reported breaches, but their consequences can extend far beyond the organisation first compromised. Stolen identity, contact, financial or customer information can be reused for fraud and targeted attacks, allowing the impact of one breach to continue long after the original incident.
AI is making phishing messages more realistic, personalised and scalable.
In its accompanying publication, AI increases the risks of cyberattacks, the AP explains how criminals can use AI to generate realistic phishing messages more quickly and on a much larger scale. Information exposed in previous breaches, including names, contact details and relationships with banks or service providers, can be used to make those messages appear credible and personally relevant.
The danger is not simply that AI can produce polished language. It can help attackers adapt messages to particular recipients, imitate familiar communications and operate across languages and channels with less effort. These capabilities reduce some of the practical barriers to conducting convincing phishing campaigns at scale.
Phishing is both a consequence and an increasingly important cause of data breaches.
The AP describes a reinforcing relationship between phishing and data breaches. Criminals can use information obtained through one breach to produce more persuasive messages; a successful message may then compromise an employee or customer account and provide access to further personal data. That newly stolen information can be used to improve the next round of attacks.
This “flywheel effect” means that data quality can work in an attacker’s favour. The more accurate and contextual the stolen information, the easier it becomes to create a message that appears to come from a trusted organisation. AI accelerates this cycle by helping criminals analyse, combine and repurpose information more efficiently.
Account takeover notifications almost tripled in a single year.
The clearest statistical evidence of the changing threat is the increase in account takeovers reported to the AP. Notifications rose from 607 in 2024 to 1,742 in 2025, almost three times as many. An apparently genuine email containing a fraudulent link may allow criminals to capture credentials, take control of an employee account and begin a wider attack against the organisation.
The AP also points to the availability of ready-made phishing kits. These packages allow people with relatively limited technical expertise to launch attacks using prepared tools and infrastructure. When such services are combined with AI-generated content, organisations may face a greater volume of credible attacks from a wider range of malicious actors.
The report does not establish that every major breach was caused by AI.
The AP’s warning concerns the way AI amplifies recognised cyberattack methods. It should not be read as evidence that AI directly caused every ransomware incident, account compromise or large-scale disclosure recorded during the year. Where the cause of a named breach has not been publicly attributed to AI, presenting that connection as fact would go beyond the available evidence.
The stronger conclusion is that organisations must now defend against familiar threats operating with enhanced speed, personalisation and scale. Phishing, credential theft and social engineering remain established risks, but AI can improve the quality and efficiency of the techniques used to exploit them.
Digital security should be treated as a board-level data protection responsibility.
The AP calls on directors and management teams, particularly in larger organisations, to make digital security a priority rather than an operational afterthought. This reflects both the potential harm to individuals and the commercial consequences of a serious incident, including disruption, remediation costs, regulatory scrutiny and loss of customer trust.
Organisations should review identity and access controls, strengthen multi-factor authentication, monitor unusual account activity and ensure employees can recognise and report sophisticated phishing attempts. Incident response processes should address not only containment and notification, but also the possibility that exposed data may be reused in later attacks.
Cybersecurity measures should also be integrated with broader data governance. Data minimisation, appropriate retention periods and access restrictions can reduce the volume of information available if an attacker succeeds. Regular risk assessments and DPIAs can help organisations identify where new technologies, processing activities or third-party services change their exposure.
Discover how Aphaia helps organisations operationalise GDPR compliance.
Effective data breach prevention requires organisations to connect cybersecurity, privacy governance and accountability. Aphaia helps organisations assess data protection risks, conduct DPIAs, strengthen incident response arrangements and build compliance programmes capable of responding to evolving AI-enabled threats.
