In Brief
AI makes phishing and other attacks harder to recognize and lowers the barrier to executing them. Even AI companies themselves sometimes lose control over their own technology, as demonstrated when an AI model independently hacked Hugging Face during a test. However, the same technology also helps identify vulnerabilities faster and handle incidents more efficiently. Want to know how resilient your organization is? Take the CyberSafe Check for culture and increase your resilience today.
An AI model became so adept at finding weaknesses in software that its creator decided not to release it: in the wrong hands, it could become a weapon for cybercriminals. Instead, Anthropic used it to help two hundred tech companies check their code for vulnerabilities. At OpenAI, things went wrong a few months later in a different way: during an internal test, an AI model escaped and hacked Hugging Face, the largest platform for sharing open-source AI models, within a few days.
Why is the cultural sector on cybercriminals' radar?
In early March 2026, thousands of European cultural institutions simultaneously experienced system outages: a ransomware attack on ticketing company Vivaticket crippled the reservation systems of institutions such as the Louvre, Musée d'Orsay, and the Bibliothèque nationale de France. The sector has also been targeted in the Netherlands, including the Rotterdam Library, Gouda Library, the Veenkoloniaal Museum, and RTV Noord.
Cybercriminals aren't looking for big names but for weak spots and valuable data: names and addresses of visitors, payment information, member registrations—exactly what most cultural organizations store. At the same time, many organizations operate with limited IT capacity, outdated systems, or few opportunities for training and awareness. This makes the sector a relatively easy target.
What changes due to AI?
AI now plays a major role in phishing: over 80 percent of phishing emails use AI in some form. As a result, phishing emails are no longer recognizable by awkward sentences or strange sender addresses; they almost perfectly mimic genuine communication.
A significant difference from earlier phishing emails is that AI now easily combines information into personalized messages. Photos, simulated voices, names, and phone numbers are effortlessly pulled together from various sources and channels by AI. Suddenly, a message appears to genuinely come from a colleague, supplier, or familiar sender. For example, engineering firm Arup lost 25 million dollars in 2024 after an employee participated in a video call where all other participants, including the CFO, turned out to be deepfakes.
The trend is also visible in the Netherlands: generative AI makes attacks easier and more scalable, although existing security measures still work effectively. What this concretely means for the numbers in the Dutch cultural sector, read in this article (opens in new tab).
AI Lowers the Barrier for Cybercriminals
You no longer need to be a technical expert to launch an attack. Researchers call this 'vibe hacking': with an AI tool, almost anyone can set up a sophisticated attack. 'Attackers aren't reinventing the wheel,' says security expert Mark Hughes of IBM. 'They're speeding up their methods with AI. The only difference now is speed.' How far this can go became evident in February 2026: using an AI tool (Claude), someone stole 150 gigabytes of personal data from 195 million people from the Mexican government. The AI did most of the work: finding weak spots, writing attack code, and siphoning off the data.
Not every attack is about stealing data. In ransomware attacks, criminals install malicious software that encrypts an organization's files and systems, making them inaccessible. Only after paying the demanded ransom do they promise to release the key to unlock everything. Until that happens, operations are paralyzed: you can't access your membership database, ticketing system, or programming, even if no files are actually stolen. And even when systems are operational again, trust isn't immediately restored: if visitors and donors notice their data wasn't secure, rebuilding that trust isn't easy.
AI Is Also an Ally
The same technology that increases the threat also helps defend against it, more often than you might think. Your email program likely already filters out phishing emails before you see them, and your antivirus software detects unknown malware not only through known patterns but also via suspicious behavior, all thanks to AI embedded in the software. You don't necessarily need to look for a new AI tool: ensure your existing software is up-to-date, and chances are you're already benefiting from this protection for free.
What Can You Do Tomorrow?
Take the CyberSafe Check for Culture, developed by DEN in collaboration with the National Cyber Security Center (NCSC), specifically for cultural organizations: you'll receive a tailored overview of actions you can take yourself. Additionally, good preparation makes a difference when something goes wrong. DEN's guide for incident and recovery planning helps you step-by-step in creating a plan for response, communication, and recovery after a cyber incident.
What Does This Mean for Your Organization?
Cybersecurity is not a task you can simply add to your to-do list as a cultural institution. It's a prerequisite for maintaining the trust of your audience. You're not alone: join the DEN Community for free and exchange experiences with other cultural organizations. External attacks aren't the whole story: equally important is how aware and skilled your own team is in dealing with AI. Read more about this in the follow-up article on shadow AI.
More articles per topic
