What the organization has confirmed
The Dutch Institute for Vulnerability Disclosure published a case file September 30 stating that attackers entered its systems through two previously unknown Zammad vulnerabilities. DIVD assigned CVE-2026-102489 and CVE-2026-102490 and opened a separate notification case. Its incident file remains open. The organization describes AI agents as involved in the attack; that attribution is DIVD’s account of its ongoing investigation.
The timeline does not settle the impact
DIVD lists initial malicious access on September 21, detection and blocking of datacenter access on September 22, and an investigation with Merlon Security beginning that day. The case file planned a further data-impact overview for October 1. A planned disclosure is not a completed finding, and the available account does not justify declaring every record compromised or every unaffected system safe.
Why support systems deserve an incident plan
Our assessment is that professional-services firms and educational institutions should use this disclosure to examine their own support-system dependencies. Tickets can connect users, administrators and outside suppliers in a single workflow. The relevant question is not whether a help-desk product looks less important than a production application, but what access and information the organization has placed behind it. This is a planning lesson from the disclosed entry point, not evidence of attacks on those sectors.
Keep known facts separate from working assumptions
For an internal incident briefing, maintain three short lists: confirmed affected systems, systems still being examined and services cleared by a stated check. Give each list an owner and a review time. Preserve the evidence supporting access revocations and recovery decisions, and keep customer communications aligned with those findings. A security provider should apply the same standard to itself that it asks clients to follow. Updates can responsibly explain progress without guessing a final breach count. The DIVD case remains a developing investigation; organizations using Zammad should follow the linked notification case and vendor guidance for product-specific information rather than infer a safe version from a news headline.
Sources & further reading
Our practical suggestions are editorial guidance. Verify applicability against current source and vendor instructions.
