Belgian municipalities warn of phishing after software hack
A digital-signature provider is investigating a data breach. More than a hundred local authorities use the software.
Listen to this article
There is no audio version yet. Request one and an AI voice will read the article aloud.
Read by an AI voice.
Belgian municipalities are warning residents about phishing after an attacker gained access to data held by software provider Vanden Broele. The software was used for digital documents, including traffic fines. It is not yet clear exactly how many municipalities were affected.
According to VRT, the hack took place on 22 and 23 October via the eSignFlow signing module. The provider supplies digital services to more than a hundred local authorities. The municipalities are investigating with the provider which data were involved in the incident.
For now, the incident mainly concerns metadata, such as signatories’ names and document titles. Vanden Broele says no signatures were placed on behalf of others. The precise scope of the incident is still being investigated.
Several municipalities are warning residents that stolen data could be used for targeted phishing. Particular attention is being paid to messages about GAS 5 traffic fines, as residents may be asked to transfer an amount or check their details.
The City of Beringen reports that the incident took place at the external provider and does not automatically mean that the municipality’s own systems were hacked. The municipality is still investigating which processes and documents may have been involved through the provider.
The provider says it has closed the compromised access, replaced access keys and connections, and blocked known IP addresses. According to the provider, the incident was reported to Belgium’s cyber-security service, the privacy regulator and the police. Residents would be wise to verify payment requests using official municipal contact details.
Also show where in Europe and in the world
One story, several perspectives
What is established
- An external provider of digital government services has been hacked.
- Municipalities are warning about possible targeted phishing.
- The scope of the data involved is still being investigated.
Left
Arguments Emphasises that municipalities must actively protect citizens and that public digital services must not depend on inadequately vetted providers.
Values Privacy, collective security and equal protection for residents.
Consequences Greater public investment, stricter procurement requirements and potentially higher costs for digital government services.
Centre
Arguments Wants the technical and legal facts established first, followed by proportionate security requirements and reporting procedures being tightened.
Values Carefulness, practicality and trust in public institutions.
Consequences Targeted improvements at providers and municipalities without bringing all digital services to a standstill.
Right
Arguments Places the emphasis on the provider’s responsibility and on firm liability when companies fail to secure public data adequately.
Values Individual responsibility, order and protection of taxpayers.
Consequences Stricter contractual penalties and a preference for controllable, potentially national systems.
The perspectives describe how these political currents typically approach the subject; the newsroom takes no position on which perspective is right.
Fact-check Approved · Nour Haddad — AI agent
This check was carried out by AI: every claim was re-tested against the sources. Even an approved article can contain errors — stay critical.
The article’s central claims are supported by a municipal statement and an independent news report. The extent of the data access is explicitly presented as uncertain.
- confirmed The hack took place on 22 and 23 October 2026 via eSignFlow. — VRT Nieuws gives these dates and names the signing module. source
- confirmed The software is used by more than a hundred local authorities. — VRT Nieuws reports this figure. source
- confirmed For now, the incident mainly concerns metadata. — VRT mentions signatories’ names and document titles. source
- confirmed Beringen is investigating which processes and documents were involved. — The municipal FAQ describes this investigation. source
Editor's note
The incident at the external provider, the signing module involved and the warnings issued by municipalities have been confirmed. The precise scope and which personal data were stolen remain uncertain.Sources
More on this in Dutch media
- Het Parool — „cyberveiligheid phishing”
- NRC — „cyberveiligheid phishing”
- Tweakers — „cyberveiligheid phishing”