Vandenbroele NV reported on October 23, 2026, that a data breach had occurred. The municipality was informed on October 25, 2026, that an external attacker had also unlawfully gained access to documents in the eSignFlow and SignService applications for the municipality on October 22 and 23, 2026. The affected website was taken offline on October 23, 2026, at 12:15 PM. After eSignFlow was restored on October 24, 2026, the passwords for the affected documents were renewed.
In total, data from 158 documents belonging to the municipality were accessed, as well as the user list of 181 users including names and email addresses. The impacted data included the title, names and roles of signatories and approvers, recipients (names and email addresses), notes, and the access code and password for each document. It is still being investigated which citizens, companies, or staff members were precisely affected.
Potential risks include an increased chance of spam emails and targeted phishing attacks, where scammers impersonate legitimate senders. The municipality urges extra vigilance for suspicious calls, emails, or messages demanding urgent action, emphasizing that official institutions will never approach individuals in such a manner to request confidential data.
Vandenbroele has implemented measures to address the vulnerabilities exploited during the hacking. The municipality is requesting details about the 158 documents to determine if personal data was impacted and from whom. Affected individuals will receive targeted communication as soon as more details are available. Staff members on the hacked user list will be informed and sensitized about the risks of future targeted phishing attacks.
The data breach was reported to the Centre for Cybersecurity Belgium (CCB) on Monday, October 26, 2026. The incident is being further analyzed in consultation with Vandenbroele, the CCB, and the municipality's IT department to prevent recurrence.
