Over 11,000 employees of 17 municipalities and organisations in Gelderland have been the subject of a large-scale, controlled phishing exercise carried out by Arnhem students from Rijn IJssel over the past two weeks. The outcome is striking: 12.7% of participants fell for the fake phishing emails developed by Rijn IJssel students.
Worrying results
A total of 12,325 phishing emails were sent to 11,476 users. The results show that phishing is a serious threat:
- 12.7% of participants were phished (1,561 out of 12,325)
- 38.8% opened the phishing email
- 17.4% opened an attachment, possibly containing malware
- 7.7% clicked on link in phishing email
- 5.1% shared sensitive data, such as a password, via a fake page
Of particular concern was the percentage of employees who entered sensitive data, over 1 in 20. Some phishing emails were easier to recognise as such than others. The campaign shows that there is definitely still to be gained around digital security awareness among the participating municipalities and organisations.
Students as ethical hackers
The phishing campaigns were fully developed and executed by students of Rijn IJssel, with the consent of the participating organisations. They designed realistic phishing emails after which they were sent through Outkept's system.
Dave Aaldering, co-owner SPL: "With the Phishathon, we let students simulate realistic attacks so that organisations can immediately see where their vulnerabilities are and we increase the knowledge level of upcoming IT specialists."
The value of this approach is also stressed from education: "Digital security is not a theoretical subject, but a skill you only develop by practising in real situations. Students experience how cyber threats work in practice, while organisations gain direct insights to increase their resilience," says Alexander van der Koevering, chairman of the MBO Digital board committee & member of the Rijn IJssel Executive Board.
This is what one of the fake emails looked like
About the Phishathon
The Phishathon is an initiative of cybersecurity company SPL, Rijn IJssel and Outkept. It is the first of its kind in the Netherlands. The event combines hands-on education with a direct contribution to the digital resilience of organisations in Gelderland.
Part of broader hackathon
The Phishathon was part of a 24-hour Hackathon on 1 and 2 April at Rijn IJssel in Arnhem. During this event, the results of the phishing campaigns will be presented and a prize will be awarded for the most convincing phishing email.
The Phishathon fits into a broader context of increasing digital threats. According to CBS, around 17% of the Dutch population (2.5 million people) will be victims of online crime in 2025. Moreover, research by SIDN showed that 58% of Dutch companies were targets of phishing last year.
About the organising parties
SPL is a cybersecurity firm based in Arnhem that helps organisations enhance their digital resilience.
Rijn IJssel is a regional vocational training institute in Arnhem that is actively committed to practice-oriented education in digital security.
Outkept specialises in ethical hacking and cybersecurity services.
