Sunday, 12 July 2026

US-China diplomatic meeting collapses over Taiwan Strait incident; security agencies warn of elevated cyber espionage tempo

Scheduled bilateral diplomatic talks between US and Chinese senior officials in Singapore collapsed on 11 July following a confrontation in the Taiwan Strait in which Chinese coast guard vessels shadowed and briefly blocked a US naval resupply mission to a Philippine ally outpost. In the aftermath, the US Cybersecurity and Infrastructure Security Agency (CISA), the UK National Cyber Security Centre (NCSC), and the Australian Cyber Security Centre issued a joint advisory warning of a probable near-term increase in Chinese state-sponsored cyber espionage operations targeting Western government contractors, defence supply chain firms, and semiconductor manufacturers. The advisory specifically flags spear-phishing campaigns impersonating trade association communications, exploitation of VPN infrastructure vulnerabilities, and Living-off-the-Land (LotL) tactics that avoid detection by blending into legitimate administrative traffic. Organisations in the identified sectors are advised to enforce phishing-resistant MFA, audit VPN firmware currency, and implement network behavioural baselines that would detect anomalous lateral movement consistent with LotL tradecraft.

Mission Support's advisory and intelligence team provides geopolitical risk assessments for organisations with international operations.

Ransomware group Fog claims attack on three European private security firms, leaks employee security clearance data

The ransomware group Fog published on 11 July what it claims are data archives from three European private security companies — two based in Germany and one in Poland — totalling approximately 2.4 GB of files including employee personnel records, security clearance application documentation, client site access protocols, and guard patrol scheduling data. If the breach is confirmed at the claimed scale, it would represent a significant operational security incident: guard scheduling data and site access protocols in hostile hands could facilitate pre-planned physical intrusions, while clearance documentation exposes individual staff to targeted recruitment or coercion by foreign intelligence services. The incident highlights a systemic vulnerability in the security industry: security firms are high-value targets precisely because their operational data provides intelligence on client premises. Security organisations are advised to treat their own data security with the same rigour they apply to client environments, including regular penetration testing, access minimisation, and air-gapped storage of the most sensitive operational records.

Mission Support's cyber security team conducts security assessments and penetration testing for organisations handling sensitive operational data.

WHO declares mpox variant Clade Ib a Public Health Emergency of International Concern for the second consecutive year

The World Health Organization Director-General declared on 11 July that the mpox Clade Ib variant — first identified in eastern DRC in 2024 and subsequently detected in 14 countries — continues to constitute a Public Health Emergency of International Concern (PHEIC), extending the emergency status first declared in 2025. The re-declaration follows data showing sustained community transmission in DRC, Uganda, Kenya, and Burundi, alongside imported cases detected in Belgium, Sweden, and the United Arab Emirates during June and July 2026. While Clade Ib transmission in Europe remains limited and associated with travel, the re-declaration has prompted renewed guidance from the European Centre for Disease Prevention and Control (ECDC) on contact tracing protocols and personal protective equipment requirements for healthcare and response workers. Organisations deploying staff to sub-Saharan Africa are advised to update their travel health risk assessments to include Clade Ib exposure protocols, pre-deployment vaccination status verification, and post-travel monitoring procedures.

Mission Support provides CBRN training and biological threat response protocols for organisations deploying staff to high-risk regions.

European Parliament passes AI Weapons Systems Oversight Resolution, calling for human-in-the-loop mandate

The European Parliament adopted by a margin of 412 to 189 on 10 July a non-binding resolution calling on EU member states and NATO allies to adopt legally binding human-in-the-loop requirements for autonomous weapons systems capable of selecting and engaging targets without direct human authorisation. The resolution, driven by growing parliamentary concern over reported use of AI-enabled drone systems in the Ukraine conflict and in Middle Eastern operations, calls for an EU-level treaty framework to be proposed to the UN by the end of 2026. While non-binding, the resolution signals strong political pressure on the European Commission to accelerate its stalled lethal autonomous weapons systems (LAWS) regulatory initiative. For the private security industry, the debate has downstream relevance: the deployment of autonomous surveillance and deterrence systems — including perimeter AI cameras with automated alert triggers and drone-based monitoring — is likely to face increasing regulatory scrutiny as the EU moves toward comprehensive oversight frameworks for autonomous systems in both military and civilian contexts.

Europol reports 40% rise in organised crime groups exploiting EU diplomatic mail channels for contraband trafficking

Europol's Serious and Organised Crime Threat Assessment update published on 10 July documents a 40% year-on-year increase in detected cases of organised crime groups exploiting diplomatic mail and pouch channels — which benefit from international legal immunity under the Vienna Convention — to traffic narcotics, weapons components, and precursor chemicals across EU borders. The threat assessment notes that corruption of mid-level diplomatic staff has been the primary entry vector, with criminal groups using a combination of financial inducement and coercive leverage to recruit couriers within diplomatic missions. Affected nations identified include several EU member states as both origin and transit points. For embassy and diplomatic security professionals, the assessment reinforces the importance of internal vetting protocols, anomaly detection in mail processing workflows, and secure chain-of-custody documentation for all items entering or leaving mission premises. The finding also underscores why TSCM and physical security for diplomatic facilities must address internal as well as external threat vectors.

Mission Support provides specialist security and TSCM services for embassies and diplomatic missions across the Netherlands and EU.

NIS2 enforcement: German BSI issues first cross-border corrective orders to non-compliant critical infrastructure operators

Germany's Federal Office for Information Security (BSI) issued corrective orders to seven critical infrastructure operators on 10 July — including three companies headquartered in the Netherlands and Belgium — marking the first use of cross-border enforcement powers enabled by the NIS2 Directive's provisions for intra-EU regulatory coordination. The orders require the operators to implement mandatory vulnerability disclosure programmes, achieve Cyber Essentials Plus equivalent certification, and submit to independent penetration testing within 90 days. Failure to comply risks fines of up to 2% of global annual revenue under NIS2's enforcement framework. The action sends a clear signal that NIS2 enforcement is no longer theoretical: regulators are using cross-border powers, and organisations in scope should not assume that being based outside Germany insulates them from BSI action if they operate infrastructure serving the German market. Dutch legal and compliance teams should map their NIS2 obligations across all EU jurisdictions in which they operate critical infrastructure or provide essential services.

Mission Support's advisory team supports NIS2 gap assessments and compliance roadmap development for Dutch critical infrastructure operators.

AIVD detects foreign intelligence operation targeting Dutch semiconductor supply chain firms in Eindhoven region

The AIVD issued a sector-specific threat notification on 11 July warning semiconductor equipment manufacturers and associated supply chain firms operating in the Eindhoven-Brainport corridor that a sustained foreign intelligence operation — attributed with high confidence to a state actor in the Asia-Pacific region — is actively targeting their intellectual property, recruitment pipelines, and customer lists. The operation has employed a combination of technical intrusion (targeting engineering workstations via watering-hole attacks on industry association websites), human intelligence approaches (unsolicited approaches to Dutch engineers at international conferences), and academic collaboration channels (offering research funding with attached IP transfer obligations). The AIVD recommends that affected firms brief engineering and business development staff on the threat profile, implement formal protocols for reporting unsolicited foreign approaches, and conduct security assessments of collaboration agreements with international academic and commercial partners. The notification follows last year's revelation that a major Dutch semiconductor component manufacturer suffered a two-year undetected network intrusion attributed to the same threat actor.

Mission Support supports technology companies with counter-intelligence briefings, TSCM sweeps, and insider threat programme design.

Rotterdam port authority completes first CBRN mass casualty exercise involving 400 emergency responders

The Port of Rotterdam Authority, in coordination with the Veiligheidsregio Rotterdam-Rijnmond, the GHOR Zuid-Holland-Zuid, and the Dutch Ministry of Infrastructure and Water Management, completed a two-day CBRN mass casualty exercise on 11 July involving approximately 400 emergency responders simulating a combined chemical and radiological release event at a container terminal. The exercise, designated 'DELTAFORCE 2026', tested interoperability between port security teams, fire services, medical first responders, and CBRN specialist units under simulated mass casualty conditions with partial communications degradation. After-action reporting is expected within 60 days. The exercise reflects growing recognition within Dutch critical infrastructure policy circles that port environments — which handle hazardous cargo at large scale in close proximity to dense urban areas — represent a credible CBRN mass casualty risk environment requiring regular full-scale rehearsal. Organisations operating within the port ecosystem, or providing security or emergency response services to port clients, should review their own CBRN response capability and integration with local emergency services.

Mission Support delivers CBRN training and response protocols for security teams and emergency responders across the Netherlands.

Den Haag municipal police report 28% increase in corporate vehicle break-ins near Scheveningen conference district

The Den Haag municipal police district issued a crime pattern advisory on 10 July documenting a 28% year-on-year increase in vehicle break-ins targeting corporate and diplomatic vehicles parked in the Scheveningen conference district, the Internationale Zone, and surrounding streets between 17:00 and 23:00. Analysis of 84 incidents between January and June 2026 indicates a coordinated criminal operation using signal boosters to relay keyless entry signals from vehicles to relay stations, enabling entry without key possession. Targeted vehicles were predominantly premium German marques and modified security vehicles identifiable by equipment (roof antennas, blackout glass, reinforced panels). Laptops, executive briefing documents, and personal valuables were the primary targets. The advisory recommends that security drivers and fleet operators use physical key shields, disable keyless entry when vehicles are unattended for extended periods, and avoid predictable parking patterns near conference venues. Executive protection teams should brief principals on document security before and after conference attendance.

Mission Support provides security drivers and executive protection services for principals travelling to The Hague and Netherlands conference environments.