Saturday, 11 July 2026

Russia expands electronic warfare corridor along Finland border, NATO confirms signal jamming affecting civilian aviation

NATO's Supreme Headquarters Allied Powers Europe (SHAPE) confirmed on 10 July that Russia has significantly expanded its electronic warfare corridor along the Finnish border. Persistent GPS spoofing and jamming now affect civilian aviation from the Gulf of Finland to northern Karelia. The Finnish Transport and Communications Agency (Traficom) recorded 847 GPS anomaly events in June 2026, a 220% increase on the monthly average for the first quarter. Commercial flight navigation, shipping in the Gulf of Finland and overland logistics in eastern Finland have all been disrupted. NATO is working with Finnish authorities on the legal and operational response options under Article 3 of the North Atlantic Treaty. If you run logistics, travel management or security operations in the area, don't rely on GPS alone. Have backup positioning, pre-planned alternative routes and clear communications procedures ready for when navigation degrades.

Our advisory team prepares travel risk assessments and contingency plans for organisations working in affected regions such as eastern Finland.

Interpol Operation Tourniquet arrests 230 suspects in coordinated strike against executive kidnap-for-ransom networks

Interpol's Financial Crimes and Anti-Corruption Centre announced on 10 July the end of Operation Tourniquet, a six-month coordinated action by police in 31 countries. It led to the arrest of 230 suspects linked to executive kidnap-for-ransom (K&R) networks in Latin America, West Africa, the Middle East and Southeast Asia. The operation also disrupted four active hostage situations in Mexico, Nigeria, Lebanon and the Philippines, and seven foreign nationals were recovered safely, including two European business executives. Intelligence from the operation shows K&R networks increasingly research companies before they strike. They study target executives through social media, company websites and flight-tracking apps to find high-value individuals, predict travel patterns and time abductions. If your executives travel to high K&R-risk destinations, review your travel security procedures, keep visible signs of status to a minimum and brief staff on keeping itineraries out of public view.

With our close protection officers and K&R risk assessments, executives can travel to high-risk destinations without drawing attention.

Microsoft Threat Intelligence discloses Midnight Blizzard campaign targeting European foreign ministries via Teams

Microsoft Threat Intelligence published technical indicators on 9 July for a renewed Midnight Blizzard (APT29 / Cozy Bear) campaign. It targets foreign ministry staff in eight EU member states through social engineering on Microsoft Teams. In the campaign, active since May 2026, attackers pose as technical support inside Teams, abusing external collaboration tenant settings so their requests appear to come from the internal IT helpdesk. Victims are talked into sharing temporary access codes, which lets the attackers enrol their own devices in the target's Microsoft 365 environment. That gives them persistent access to email, SharePoint and Teams conversation history. According to Microsoft's assessment, accounts at foreign ministry level have been compromised in at least three EU member states. If you use Teams with external collaboration switched on, audit guest access settings and turn off automatic approval of external users. Use conditional access policies that check device compliance before external tenants get in.

Our cyber security team helps embassies and diplomatic organisations check their Teams and Microsoft 365 set-up and respond to incidents.

EU Foreign Affairs Council approves expanded sanctions package against Belarus, targeting security apparatus members

The EU Foreign Affairs Council approved a new round of targeted sanctions against Belarus on 10 July. It designates 47 more individuals and 12 entities linked to the Belarusian security services, the state broadcaster and the judicial system responsible for the continued repression of civil society. The package includes asset freezes and travel bans. It also widens existing sanctions to cover people who help use irregular migration as a hybrid threat tool against EU member states. Individuals connected to the forced diversion of transit flights to Minsk are targeted too, extending the 2021 aviation sanctions imposed after the Ryanair incident. For security professionals this matters in due diligence. If you do business in Belarus or with counterparts connected to it, screen against the expanded list and re-examine supply chain relationships with state-linked Belarusian entities.

ECDC updates travel health guidance for sub-Saharan Africa following Clade Ib mpox spread to new provinces

The European Centre for Disease Prevention and Control (ECDC) updated its travel health guidance on 10 July for travellers and organisations sending staff to sub-Saharan Africa. The update follows Clade Ib mpox transmission in three new provinces in Uganda and confirmed sustained community spread in South Sudan. The ECDC has raised the risk category for travel to the affected provinces. Healthcare workers and security personnel likely to have close contact with local people should get the MPX vaccine (JYNNEOS) if not already vaccinated, carry suitable PPE and follow stricter hygiene procedures. Organisations with field teams in the region, including humanitarian security managers, corporate security staff at extractive industry sites and close protection officers, should check vaccination status and brief their medical teams. The ECDC notes that JYNNEOS supply in the EU is still limited and recommends ordering early.

Our pre-deployment training includes health risk briefings for staff heading to regions such as Uganda and South Sudan.

Schengen border management agency Frontex reports record interceptions of concealed surveillance equipment at EU external borders

Frontex's Risk Analysis Unit published a quarterly threat assessment on 9 July. It documents a record number of concealed surveillance and interception devices seized at EU external borders in the second quarter of 2026: 312 devices at border crossings in 18 member states. They included miniaturised IMSI catchers, hidden audio transmitters, covert video devices built into everyday objects and modified GPS trackers. The report says concealment keeps getting more sophisticated, with several items needing laboratory analysis to tell them apart from the legitimate electronics they were hidden in. For security professionals and diplomats crossing EU external borders, this means a lot of surveillance equipment is in circulation, and a standard luggage X-ray will not catch every type. Mission staff and executives coming back from hostile environments should consider a TSCM check of their devices and personal belongings before returning to sensitive workplaces.

We carry out TSCM checks of devices, personal belongings and offices for staff returning from hostile environments.

Politie confirms arrest of three men linked to series of high-value art and executive vehicle thefts in Amsterdam South

Amsterdam-Amstelland police confirmed on 10 July the arrest of three men, aged 28, 34 and 41. They are suspected of involvement in a series of 19 high-value thefts of art collections and premium vehicles in Oud-Zuid and the Apollobuurt between April and June 2026. The suspects are believed to have watched their targets in advance, tracking daily routines and spotting when security was weakest. Two of the arrests came from analysis of ANPR camera data and a tip from a private security contractor whose mobile patrol had flagged suspicious behaviour. The case shows the value of combining physical and electronic surveillance, and how information from private security can add to what the police detect. If you live or run a business in a high-value area, look at mobile patrols, CCTV with off-site monitoring and a fast response when an alarm goes off.

Our mobile patrols and alarm response serve residential and commercial clients across Amsterdam, including neighbourhoods such as Oud-Zuid.

Dutch Ministry of Justice launches NIS2 sectoral audit programme for financial services and healthcare, first inspections from September

On 10 July the Dutch Ministry of Justice and Security published the operational framework for the Netherlands' NIS2 sectoral audit programme. The Rijksinspectie Digitale Infrastructuur (RDI) will run the first round of compliance inspections in financial services and healthcare from September 2026. The first inspections will look at three areas. Governance documentation covers board-level ownership of cyber risk and documented incident response plans. Technical controls cover patch management cadence, MFA and network segmentation. Supply chain security covers third-party security assessments and contractual security requirements. Organisations under NIS2 that cannot show documented processes in these areas face formal enforcement under the Cybersecuritywet, which transposes NIS2 into Dutch law. The September start leaves roughly eight weeks to close gaps. If you are in scope, run a quick gap assessment and fix the highest-risk documentation gaps before the inspections start.

Our advisory team runs NIS2 gap assessments for Dutch financial and healthcare organisations and helps get the documentation ready before the RDI arrives.

Utrecht University Hospital conducts first joint hazardous-materials mass-casualty drill with Veiligheidsregio Utrecht responders

UMC Utrecht and the Veiligheidsregio Utrecht held a joint hazardous-materials mass-casualty exercise on 9 July. It simulated a chemical agent release at a public transport hub, with 150 simulated casualties needing specialist decontamination and triage. It was the first exercise of its kind at UMC Utrecht. It tested whether the hospital could activate its hazardous-materials mass-casualty protocol, set up an outdoor decontamination corridor and coordinate patient intake with hazmat-equipped responders from the regional fire service and GHOR Utrecht. Observers from four other Dutch university hospitals took part, as part of a national programme to give all ten academic medical centres a standard hazardous-materials mass-casualty capability by the end of 2027. The NCTV coordinates the programme. It reflects a growing view that hospitals must be able to receive casualties from a hazardous-materials incident, as well as protect themselves from one. That takes dedicated training beyond standard mass-casualty planning.

For hospitals and responders preparing exercises like Utrecht's, we provide hazardous-environment training and exercise facilitation across the Netherlands.