When Payments Break: What Today’s Dutch Outages Tell Us About Our Digital Infrastructure
Author: Berend Watchus. Independent non-profit AI & Cybersecurity Researcher. Publication for OSINT Team, online magazine.
When Payments Break: What Today’s Dutch Outages Tell Us About Our Digital Infrastructure
May 27, 2026
Today is a bad day to buy something in the Netherlands.
Just after 15:00 CEST, reports started flooding in: MultiSafePay — one of the country’s largest payment service providers — was failing. By the time the company officially acknowledged the incident on its status page at 15:49, calling it “platform performance degradation,” the real-world impact had already been mounting for the better part of an hour. In practice, that lag matters: hundreds, possibly thousands, of Dutch webshops could no longer create transactions while merchants and customers were left to figure it out for themselves. iDEAL failed. Visa failed. Even bank transfer — a payment method where you literally just send money to an IBAN — failed, because MultiSafePay sits in the middle of that too.
And as if that weren’t enough: in the same afternoon, Downdetector also spiked for PIN payments. People standing at the checkout with a debit card couldn’t pay in many places. Two independent outages, the same afternoon, the same country, the same payment domain. Whether it’s coincidence, or a coordinated problem somewhere deeper in the chain, we don’t know at the time of writing. What we do know: a webshop offering ten or fifteen payment methods — iDEAL, Visa, Mastercard, American Express, PayPal, Bancontact, SOFORT, Klarna, Apple Pay, Google Pay, bank transfer — can suddenly sell nothing at all. Not “fewer sales”, not “degraded conversion.” Nothing. A checkout page full of logos becomes a checkout page full of dead buttons, because every single one of those methods is being created and routed through the same upstream service. When that service falls over, the visible variety on the page is exposed for what it is: theatre.
The individual shop isn’t the problem
Let me set something aside before going further, because it would otherwise hang over the whole article.
A single webshop losing a few hours of sales is, from that shop’s perspective, an acceptable cost. They’ve run the numbers. A second PSP integration, ongoing maintenance, reconciliation across two providers, support staff trained on two dashboards — all of that costs real money, every month, forever. Compared to the occasional bad afternoon, it’s a worse deal. If you’re running a furniture store or a doek webshop, eating one ruined Wednesday a year is genuinely cheaper than engineering your way out of it. That’s a rational decision. I’m not arguing with it, and I don’t expect the shop to behave differently. This article is not advice for merchants.
The reason that calculation deserves attention isn’t the calculation itself — it’s what happens when every merchant runs the same numbers and arrives at the same answer. Individually rational, collectively catastrophic. Each shop optimises locally; the result is that an entire country’s checkout layer ends up perched on three or four pieces of shared infrastructure. None of them coordinated this. None of them chose centralisation. They each just picked the cheapest option, and the cheapest option happened to be the same option as their neighbour’s. And their neighbour’s neighbour’s.
That collective exposure is what this article is actually about. Not the shop. The shape of the dependency.
We don’t live in peacetime anymore
This is where the conversation has to shift, because the collective exposure described above would already be a structural problem in a calm geopolitical environment. We don’t live in one — and the Dutch state has been saying so, with increasing clarity, for some time now.
It is fair to argue about exactly when the posture changed. Generals, intelligence chiefs, and senior politicians had been warning publicly for years that the security environment had deteriorated. The MIVD and AIVD annual threat reports grew steadily blunter. NATO commanders, including the current Secretary General, told European populations to prepare mentally for war. The vocabulary of “hybrid threats,” “grey zone,” and “non-kinetic conflict” moved from think-tank papers into ministerial speeches. None of this was secret. None of it was sudden.
What was new, in late 2025, was the mode of delivery. Through the Denk Vooruit campaign, coordinated by the NCTV (the National Coordinator for Counterterrorism and Security), the government for the first time put a written, explicit message into the letterbox of every household in the country simultaneously: prepare for crises that explicitly include war and cyberattacks on critical infrastructure; expect to be self-sufficient for the first 72 hours; the central government may not be able to help you immediately.
Eight and a half million households, in writing, from the state, at once. That is a categorically different act from a general giving a speech or a minister being interviewed. It is the government addressing the entire civilian population directly and on the record. Whatever the security establishment had been saying internally and at conferences for years, this was the moment it became official correspondence with the public.
A second detail is worth pulling out, because it changes the threat model the booklet is built around. The traditional you never know kit was designed for one scenario: stay home, ride out a few days of disruption, wait for help. The Dutch booklet does that — and then explicitly does more. It tells citizens to assemble a kit that is also a bug-out bag: portable, ready by the door, carried on your back if you have to leave. It tells you to make a noodplan with a meeting point in case you can’t return home, to keep copies of identity documents on your person, to know your routes out. That is a different document for a different category of event. A shelter-in-place kit assumes home is the safest place. A bug-out kit assumes home may not be. Including both in the same booklet means the state is preparing the population for a spectrum that runs from “no power for three days” all the way through to “leave now and don’t come back tonight” — and is no longer willing to leave the second half of that spectrum unspoken.
The strange thing — and arguably the most telling part of the story — is how thoroughly the press declined to read any of this for what it was. The coverage that followed was almost entirely a lifestyle segment. Interviews with prepper-store owners about a sudden uptick in sales. Vox pops on the street asking people how long they could survive on what was in their kitchen. Lighthearted features on the contents of a noodpakket: flashlights, blankets, tinned soup. The framing was quirky public-information campaign rather than the state has formally told the population that the security environment has changed, and that the realistic scenarios now include leaving your home on foot. The signal was loud. The reception was strangely quiet.
There is no hot war on Dutch soil. No front line, no mobilisation, no siren. But the period of post-Cold-War security in which infrastructure could be designed for efficiency alone is over. Hybrid threats — actions by state and non-state actors designed to undermine or damage an adversary without crossing the threshold of conventional war — are no longer theoretical or occasional. They are continuous and daily. Undersea cables severed in the Baltic. Pipelines sabotaged. DDoS waves against European banks. Russian and Russian-aligned actors openly targeting energy, water, and transport systems across the continent. GPS interference across the north. The 2024 CrowdStrike incident — not even an attack, just a faulty update — taking down airlines, hospitals, payment terminals, and emergency services worldwide in a single morning. The threat environment, measured in cyber and hybrid terms, has not been this tense since the 1980s, and arguably it’s worse: the attack surface today is unrecognisably larger than it was forty years ago.
So here is the actual question this article is asking. We have entered a period that our own government has now told us, in writing and at scale, is no longer peacetime. The realistic scenarios it is preparing us for include not just sitting out a storm but walking out the front door with everything we need on our backs. Hybrid and cyber operations against critical infrastructure are happening every day, somewhere in Europe, including against systems Dutch citizens depend on. And in that environment, we have quietly allowed the rails beneath modern commerce to concentrate onto a handful of shared dependencies — a few PSPs, a few cloud providers, a few card schemes — each one a single point of failure for a meaningful slice of the economy. Today’s MultiSafePay outage could be a routine technical failure, a misconfigured deployment, a misbehaving dependency, an overloaded database — or it could be something deliberate. We don’t know. We may never know with certainty. That is the point. The system is now built such that the cause is opaque to those affected, while the effect — checkout pages full of dead buttons across an entire country — is the same in every scenario. A configuration error and a coordinated attack present identically to the merchant losing the sale and the customer who can’t pay. That’s not resilience. That’s a target.
The 49-minute gap
Before going further, that 49-minute gap deserves its own moment. The Downdetector curves for both MultiSafePay and iDEAL begin their near-vertical climb just after 3 p.m. The status page didn’t say a word until 15:49. That’s not unusual — it’s standard. Incidents have to be detected, triaged, classified, and signed off on before they appear publicly. Engineers are debugging while the comms team is drafting language. Forty-nine minutes is, frankly, reasonably fast for a corporate status update.
But here’s the thing: in that 49-minute gap, every merchant relying on MultiSafePay was effectively flying blind. Customers were getting cryptic error messages (“500 System error”, “1014 Back-end: unspecified error”), shop owners were checking their own logs assuming the problem was on their end, and no one had any official confirmation that the outage was upstream. The reporting regimes we’ll discuss later are built around capturing these incidents after they happen. They do nothing to compress the window in which everyone affected is left in the dark.
How a single vendor takes down an entire market
Most Dutch webshops route their checkout through a handful of PSPs: Mollie, MultiSafePay, Adyen, Buckaroo, Pay.nl. The shop itself doesn’t talk directly to iDEAL, Visa, or your bank. Everything flows through the PSP. It acts as the central cashier that creates the transaction, forwards it to the chosen payment method, and reports the result back to the shop.
It’s an elegant design — until the cashier collapses. At that point, it doesn’t matter which payment method you pick in the checkout. iDEAL, credit card, Bancontact, bank transfer — they all die at step one, because the PSP can’t even register the transaction. Ten visible options, one invisible point of failure.
Even bank transfer isn’t what it used to be
The bank transfer case deserves a closer look, because it’s the cleanest example of a once-resilient method that has been quietly hollowed out.
In the late nineties and early two-thousands, paying a webshop by bank transfer was charmingly mechanical. The shop displayed its IBAN, an amount, and a unique reference code. You’d open your banking app (or, further back, paper forms), enter the details, and send the money. Two or three days later someone in the back office would tick your order off against the bank statement and ship it. No external party in the middle. No upstream service to fail. If your bank worked and the shop’s bank worked, you could pay — and even if the shop’s website was down, you could still send the money based on details you’d written down. The method was crude but genuinely independent.
Today, in almost every modern webshop, that’s gone. “Bank transfer” in the checkout looks identical, but underneath it now runs through the same PSP as iDEAL and the cards. The PSP creates the transaction, generates the reference, watches the merchant’s (often virtual) IBAN for incoming funds, automatically matches the payment to the order, and triggers downstream processes — invoicing, fulfilment, accounting. Merchants love it because it eliminates manual reconciliation, gives them one dashboard for all payouts, and removes the bookkeeping headache. PSPs love it because every transaction — even a “pure” bank transfer — generates a fee. Shopify, WooCommerce, Magento and the rest love it because it ships out of the box.
What disappeared in the process is the one method that didn’t need anyone else to be up. The very payment type that should be the natural fallback when everything else fails has been re-engineered to fail alongside everything else. And critically: nobody hid this. It’s not a scandal, it’s not a regulatory violation — it’s a deliberate trade-off. Shops looked at the math and decided that 99.9% uptime is good enough, manual reconciliation is too expensive, and the occasional outage afternoon is an acceptable cost. It’s calculated failure. From a single shop’s spreadsheet perspective, it’s even rational.
That rationality is the whole problem.
This isn’t about one shop’s bad afternoon
Here is where the article you’re reading parts ways with most coverage of incidents like today’s. The usual angle is “MultiSafePay was down, here’s how much revenue webshops lost, here’s what merchants should do next time.” That framing is too small. It treats the outage as a commercial event affecting individual businesses, the way you’d cover a hailstorm damaging a particular vineyard.
What today actually exposes is something structural. When a single PSP outage can simultaneously freeze checkout on thousands of independent webshops — none of which share infrastructure, none of which know each other, none of which made the same engineering decisions — what you’re looking at is not a collection of small business problems. You’re looking at a shared dependency that has quietly become a layer of national infrastructure. The shops didn’t agree to centralise. The market centralised them, one rational cost-saving decision at a time.
Now scale that out. The same dynamic plays out across borders. Mollie, Adyen, Stripe, Worldline, Nexi and a handful of others sit beneath enormous swathes of European e-commerce. iDEAL itself is being absorbed into the European Payments Initiative’s Wero scheme. The card networks (Visa, Mastercard) provide the rails under almost everything else. Cloud infrastructure (AWS, Azure, Google Cloud) provides the rails under those. Each layer is more concentrated than the one above it, and each layer’s failure cascades into all the layers below.
A single PSP going down for an afternoon in one country is the small version of this story. The large version is what happens when the dependency surfaces above — payment orchestration, card scheme messaging, cloud regions, undersea cables — have a bad day. We’ve already had previews.
On November 18, 2025, Cloudflare — which sits in front of roughly 20% of all web traffic — suffered a global outage that took down ChatGPT, Claude, X, Spotify, Shopify, Canva, Discord, and thousands of other sites and services for roughly two hours.
*“Parts of the internet went down”
That was the phrase. The Independent ran it almost verbatim in one piece of coverage that day. In another, the same outlet headlined: “Cloudflare down: Internet stops working properly amid major outage.” The lead read: “Cloudflare has gone down, taking many other websites down with it. The outage affected much of the web.”
Get Berend Watchus’s stories in your inbox
Join Medium for free to get updates from this writer.
Read those sentences again with the casualness stripped away. The internet stopped working properly. The outage affected much of the web. Stated as neutral facts. Tagged, captioned, monetised. 6,700 views. 18,000 views. Scroll on.
Nobody — not the broadcasters, not the audience moving past the headline — seemed to register how strange those sentences actually are. The internet. Stopping. In parts. The infrastructure layer underneath modern banking, modern logistics, modern hospitals, modern government, modern defence communications, modern payments. And the public framing was a mild inconvenience. The vocabulary the press reached for, almost automatically, was the vocabulary of a traffic jam: parts, down, stopped working properly, affected. Words you’d use about a tram line, not about the substrate of global commerce.
It is the same pattern as the booklet through the letterboxes a few weeks later. The signal was loud, the reception was strangely casual. The state telling 8.5 million households to prepare for war and cyberattacks became a lifestyle segment about flashlights and tinned soup. A meaningful slice of the global internet going dark became a TikTok-friendly news clip with the engagement of a mid-tier cooking video.
We have built a system where the internet stops working properly can happen as a sentence. And we have reached a cultural place where that sentence doesn’t disturb anyone for more than the time it takes to refresh the page.
— — — — — — — — — — — — — — — — — — — — -
I was writing about that outage in real time when, mid-article, my own publishing platform (Medium) went down with the exact same Cloudflare error page I’d just been documenting. The tool I was using to warn people about centralisation was itself a hostage of the thing I was warning about. The cause turned out not to be a cyberattack but a change to database permissions that caused a “feature file” used by Cloudflare’s Bot Management system to double in size and propagate to every machine in the network. Downstream losses were enormous: Shopify alone took over $4 million in direct losses with merchant-side impact estimated above $170 million, and the total damage across affected platforms was put at over $250 million. Two details from that day matter for this article. First, the symptoms kept flickering on and off as the bad file regenerated every five minutes, which made Cloudflare’s own engineers initially think they were under a massive DDoS attack rather than experiencing an internal configuration error — meaning even the operator of the platform couldn’t immediately tell whether they were being attacked or had broken themselves.
Second, Downdetector — the website built specifically to track outages of other services — was itself taken down by the outage it was meant to monitor.
The dependency tree had become so deeply recursive that even the diagnostic layer was captive to the failure.
And less than three weeks later, on December 5, 2025, Cloudflare went down again.
The company then declared an internal initiative called “Code Orange: Fail Small,” explicitly to ensure that the cause of those two consecutive global outages would never happen again. Cloudflare + 3
ARPANET
Step back from the specifics and there is a deeper irony: the public internet evolved from ARPANET, a network whose original design mandate was to survive a nuclear strike through radical decentralisation. Five decades later, its commercial descendant can be crippled for two hours by a misconfigured feature file at a single vendor. The resilience property was real; we sold it. Not in a single decision, but in the same slow accumulation of individually rational choices that pulled webshop checkouts onto three or four PSPs. Speed, cost, convenience — each layer of the stack chose them, and each layer of the stack thereby chose the single point of failure that came with them. ARPANET had to survive nukes. The modern internet cannot survive a doubled file.
Other recent previews from the same shelf: the 2024 CrowdStrike incident grounded airlines, froze hospitals, and disabled card terminals worldwide in a single morning, not because CrowdStrike attacked anyone but because they pushed a faulty update. ION Trading’s 2023 ransomware incident froze derivatives trading across major banks. AWS us-east-1 outages have repeatedly taken down half the consumer internet for hours at a time. These aren’t outliers. They’re the visible spikes of a curve we’ve been climbing for two decades.
The Netherlands is a useful canary because it’s small, dense, and unusually cashless. Whatever resilience problems show up here will show up everywhere else that follows the same trajectory — which is most of the developed world. Today’s incident is not a Dutch problem. It’s a Dutch preview.
So what about the regulation?
This brings us to the real question: is anything being done? And is that an EU phenomenon, or is the rest of the world handling it differently? The short answer: a lot is happening on paper, very little in practice, and the EU is ahead — but “ahead” is a low ceiling.
European Union — DORA. Since January 17, 2025, the Digital Operational Resilience Act has been in force. DORA harmonises operational resilience rules for the financial sector and applies to 20 different types of financial entities and ICT third-party service providers. The regulation covers more than 22,000 financial entities and ICT providers operating within the EU, plus the ICT infrastructure supporting them from outside the EU. The five pillars are ICT risk management, incident management and reporting, resilience testing, third-party risk management, and information sharing. PSPs are explicitly in scope.
United Kingdom — its own regime. The UK doesn’t participate in DORA, but has built a comparable framework through the FCA. The FCA’s operational resilience framework, in force since 31 March 2022 with a transitional period ending 31 March 2025, requires firms to identify their important business services, set impact tolerances for the maximum tolerable disruption per service, and carry out mapping and testing to remain within those tolerances. For PSPs and e-money institutions, this applies through the SYSC handbook. In January 2026, EU and UK regulators signed a Memorandum of Understanding on cooperation in the oversight of critical third parties. The two regimes resemble each other, but aren’t identical.
United States — fragmented. No federal DORA equivalent. Oversight is split across several agencies: the FFIEC emphasises identifying critical business functions, developing strategies for operational continuity during disruptions, and conducting risk assessments and regular testing; the OCC focuses on risk management frameworks, embedding resilience into organisational culture, and continuous monitoring. The FDIC and Federal Reserve also play a role. For pure payment processors that aren’t banks — which most PSPs are — oversight is considerably lighter. Standards like PCI DSS apply, but those are primarily about data security, not uptime.
Globally. The Financial Stability Board and Basel Committee have issued recommendations on operational resilience in recent years, but those are recommendations — not legislation. The picture, then: the EU is the most formalised, the UK follows closely, and the US has a patchwork of guidance that primarily touches banks and largely leaves PSPs alone.
Why incident reporting doesn’t help
Here’s the core of the problem: most of what regulators demand is posterior. You have to report incidents, you have to have plans, you have to run tests, you have to maintain documentation. None of that says anything about whether the system actually works on a Tuesday afternoon in May. Or, as today shows, a Wednesday afternoon.
You can be fully DORA-compliant and still be down for six hours. The fine for non-compliance is real; the fine for being compliant-but-offline is zero. That’s not accidental — mandating actual uptime is hard. You’d have to define what counts as an outage, who measures it, what the SLA is, what the penalty is, and how to enforce it across providers of wildly different sizes. Regulators reach for the tool they know: paperwork. It’s measurable, it’s enforceable, and it doesn’t require engineering judgment.
The telecom sector went through this exact cycle half a century ago. Phone networks went down. Once regulators mandated “five nines” (99.999% uptime) with financial penalties, telcos suddenly built the redundant infrastructure that made outages rare. It wasn’t goodwill — it was money on the line. Payment infrastructure is still in the “we ask for it in a document” phase.
A gift for threat actors
From an offensive security perspective, this is a strikingly fragile configuration. You don’t have to hack a PSP to cause major damage — you only have to make it unreachable. DDoS-for-hire costs a few hundred euros. The asymmetry between attack cost and economic damage is enormous. State-aligned actors now use this tactic routinely: deniable, cheap, effective.
Whether today’s MultiSafePay incident is an attack, a software issue, or an infrastructure problem, we don’t yet know. The effect is identical. And that’s the uncomfortable point: to the victim — the webshop, the consumer, society — it doesn’t matter. The attacker doesn’t even have to succeed; they just have to pick the right link in the chain.
What would actually work
A few things none of the current regimes do well enough:
Mandatory financial compensation to affected merchants per hour of outage. Skin in the game. As long as the PSP doesn’t feel pain from its own downtime, the cost-benefit math stays misaligned.
Minimum redundancy requirements. PSPs above a certain transaction volume should have to demonstrate geographic and vendor diversity. Not “we have a DR plan”, but “here is an independent secondary route that takes over within X minutes.”
Public, regulator-verified uptime figures. Not self-reported status pages. Not PSP-defined “degradation” categories. Real, comparable numbers.
Faster, mandated public disclosure. Forty-nine minutes between real impact and official acknowledgement isn’t a scandal in itself, but in aggregate that’s millions of euros of merchant decisions made without information. A regulator could mandate a maximum window — say, 15 minutes — between detection and public posting, with penalties for missing it.
Liability shift. If the PSP goes down and the merchant can demonstrably prove lost revenue, the PSP pays. Today the merchant absorbs it.
Mandatory fallback options. A statutory minimum that some payment route must remain functional when the primary PSP fails — without dictating which one. Shops won’t voluntarily go back to manual reconciliation; they’ve already shown they’d rather eat downtime than rebuild bookkeeping workflows from twenty years ago. So the regulation has to force the cost forward, not back. Options include: requiring large webshops above a revenue threshold to integrate a secondary PSP with automatic failover, or requiring PSPs themselves to operate in active-active pairs across independent infrastructure. Either way, the burden has to land somewhere that has the engineering capacity and the financial incentive to actually build it — not on a single merchant clinging to a spreadsheet.
In closing
Today is an ordinary Wednesday, and yet part of the Dutch payments infrastructure is at a standstill. Webshops are losing revenue. Customers who needed something today are walking — to a competitor with a different PSP, to a physical shop if they can find one, or away from the purchase entirely. Small shops will lose a slice of today’s traffic permanently to the larger players who happen to be on a different provider. Meanwhile, someone at a checkout counter is holding a debit card that doesn’t work and has no idea why. The regulation exists. The plans exist. The reports will be filed. And in a few weeks there will be a post-mortem stating that all procedures were properly followed.
That’s the problem. The story isn’t one PSP, one country, one afternoon. It’s that across a continent — and across the wider developed world —
the rails beneath modern commerce have quietly concentrated into a handful of shared dependencies, each one optimised for the median day and exposed on the bad ones.
We’ve built a system that’s optimal on good days, fragile on bad ones, and regulated in a way that mostly measures whether the paperwork is in order. The EU is further along with DORA than the rest of the world, but being further along than a low ceiling isn’t an achievement.
The Dutch government sent 8.5 million households a booklet telling them how to survive the moment the lights go out. The same government, the same continent, has not yet redesigned the systems most likely to be targeted when they do. Until that gap closes — until real consequences are attached to outages, financially, structurally, enforceably — days like today remain the quiet evidence that our digital infrastructure looks stronger than it actually is.
End of Document
— — — — — — — — — —
Perhaps interesting, also today in the news 6 hours ago:
