Cybersecurity · official sources
Cyberattacks in Belgium
A few notable incidents, included only if confirmed by the victim itself (press release, official website, report) or by an authority (CCB, government, regulator, Data Protection Authority). The type of attack and the perpetrator are only given when officially confirmed. This is not a complete list, and there is no score or ranking.
Key figures
73,290
Computer crime offences recorded by the police in Belgium, 2025
compared with 18,074 in 2015
Police crime statistics, data as of 24/04/2026 : police.be/statistiques
61,068
of which computer fraud, 2025
Recorded offences, not victims or attacks on organisations.
Police crime statistics, data as of 24/04/2026 : police.be/statistiques
105
Ransomware incidents, 2025
compared with 109 in 2024
Centre pour la Cybersécurité Belgique (CCB), 26/03/2026 : More attacks, more reporting: Belgium's cyber reality in 2025
635
Incident notifications received by the CCB, 2025
Notifications received, not all attacks.
Centre pour la Cybersécurité Belgique (CCB), 26/03/2026 : More attacks, more reporting: Belgium's cyber reality in 2025
Public administrations and services 10 incidents
Federal services, municipalities, social welfare centres, inter-municipal bodies, public networks and local government websites.
28/10/2026
FPS Finance
Type not officially statedData leak not confirmedOngoingCyberattack on the digital services. As a precaution, MyMinfin and several other services are temporarily unavailable; extra time will be granted for returns with specific income.
- Data :
- According to the FPS, nothing indicates a data leak; this is being analysed.
- Recovery :
- Services being restored as of 28/10/2026.
- victim · SPF Finances (news.belgium.be), 28/10/2026 : Incident de cybersécurité au SPF Finances
March 2026
Municipality of Nandrin
RansomwareData leak possibleRecovery not statedRansomware attack on part of the IT infrastructure: systems isolated, data restored from backups. Incident reported to the data protection authority, the police and the CCB.
- Data :
- According to the municipality, some data (name, first name, address, national register number) may have been accessible to the attackers; no definite publication identified.
- Recovery :
- Technical investigation still ongoing, according to the municipality.
- victim · Commune de Nandrin : Information importante concernant un incident de cybersécurité impliquant certaines de vos données personnelles
14/04/2025 · announced 15/04/2025
Municipality and social welfare centre (CPAS) of Jemeppe-sur-Sambre
RansomwareData leak not confirmedRecovery not statedA ransomware-type IT incident disrupting the systems of the municipality and the CPAS, according to their press release.
- Data :
- The press release does not mention a leak.
- Recovery :
- No date of full recovery published; the online counter, suspended for security, was back online on 23/06/2025 according to the municipality.
- victim · Commune de Jemeppe-sur-Sambre, 15/04/2025 : Communiqué : la Commune et le CPAS de Jemeppe-sur-Sambre victimes d'une cyberattaque
- victim · Commune de Jemeppe-sur-Sambre, 23/06/2025 : L'E-guichet de la Commune est à nouveau accessible
07/10/2024 · announced 09/10/2024
Public websites (provinces, municipalities, ports)
Denial of service (DDoS)Data leak not confirmedRestoredOn 7 October 2024 the websites of the 7 provinces are disrupted; on 8 October some 15 municipalities and ports are targeted. Through a shared hosting partner, the websites of more than 300 municipalities go down for 3 minutes to several hours. Little or no impact on other services.
- Data :
- The CCB states that systems are not broken into.
- Recovery :
- Interruptions limited in time, according to the CCB.
- Official attribution :
- The CCB refers to a "pro-Russian hacktivist group", without naming it.
- authority · Centre pour la Cybersécurité Belgique (CCB), 09/10/2024 : Several Belgian websites affected by DDOS attack
- authority · Centre pour la Cybersécurité Belgique (CCB), 11/10/2024 : Nog steeds hinder door DDoS-aanvallen
05/12/2022 · announced 19/12/2022
City of Antwerp (city IT system)
Type not officially statedData leak confirmedPartly restoredCyberattack in the night of 5 to 6 December 2022: many of the city's digital systems and tools work poorly or not at all, affecting services to citizens. The city chose not to contact the attackers or pay. Judicial investigation ongoing.
- Data :
- Data was stolen, "mainly internal administrative data" (accounting, staff) according to the city, which does not rule out a leak of sensitive data.
- Recovery :
- Step-by-step restart; the most urgent processes targeted for end of January 2023, other applications much later (press release of 19/12/2022).
- Official attribution :
- The city itself names the "hacker collective Play".
- victim · Stad Antwerpen, 19/12/2022 : Aanpak cyberaanval
Date of events not published · announced 18/07/2022
Belgian Defence
Type not officially statedData leak not confirmedRecovery not statedThe government exposes malicious activities that targeted Defence, without giving their date or scale. Only the date of the declaration is known.
- Data :
- The declaration says nothing about data.
- Recovery :
- Not stated.
- Official attribution :
- The government links these activities to the groups UNC2814, GALLIUM and SOFTCELL, which it describes as Chinese advanced persistent threats (declaration of 18/07/2022).
- authority · SPF Affaires étrangères, 18/07/2022 : Declaration by the Minister for Foreign Affairs on behalf of the Belgian Government (malicious cyber activities)
13/05/2022 · announced 28/06/2022
Vivalia (inter-municipal healthcare provider, Luxembourg province)
Type not officially statedData leak not confirmedPartly restoredIn the night of 13 to 14 May 2022, all information systems are hit: every function stops, most software and production data are corrupted.
- Data :
- The Vivalia documents used do not mention a leak.
- Recovery :
- Restart then phased rebuild; on 31/12/2022 some tools were not yet restored (activity report).
- victim · Vivalia, 28/06/2022 : Communiqué, assemblée générale du 28 juin 2022
- victim · Vivalia, 01/06/2023 : Rapport d'activités 2022 (p. 23)
21/06/2021
City of Liège
Type not officially statedData leak not confirmedRecovery not statedLarge-scale targeted computer attack, "apparently criminal in nature" according to the City. Civil registry, Population and other services heavily disrupted.
- Data :
- No leak announced in the press release.
- Recovery :
- Restoration date not found in an official source.
- victim · Ville de Liège, 21/06/2021 : La Ville de Liège victime d'une attaque informatique
04/05/2021
Belnet (network for universities, research and public administrations)
Denial of service (DDoS)Data leak not confirmedRestoredLarge-scale denial-of-service attack from 11 a.m.: about 200 connected organisations (universities, administrations, research centres) fully or partly cut off from the internet. Perpetrators unknown, complaint filed with the FCCU.
- Data :
- According to Belnet, nothing indicates an intrusion or data theft.
- Recovery :
- Attack under control the same evening, according to Belnet.
- victim · Belnet, 05/05/2021 : Update : réseau Belnet à nouveau disponible, nos équipes restent vigilantes
April 2019 · announced 25/05/2021
FPS Interior
IntrusionData leak not confirmedRestoredTargeted and sophisticated intrusion into the network, present since April 2019 and discovered in March 2021. The FPS mentions suspected espionage. Investigation by the federal prosecutor.
- Data :
- No quantified or confirmed leak in the sources used.
- Recovery :
- Network cleaned and secured, according to the FPS (May 2021).
- Official attribution :
- The government links these activities to the groups APT27, APT30 and APT31, which it describes as Chinese advanced persistent threats (declaration of 18/07/2022).
- victim · SPF Intérieur, 25/05/2021 : Le SPF Intérieur a fait face à une cyberattaque et modernise son infrastructure informatique
- authority · SPF Affaires étrangères, 18/07/2022 : Declaration by the Minister for Foreign Affairs on behalf of the Belgian Government (malicious cyber activities)
Companies, hospitals and associations 4 incidents
Private or non-profit organisations, when the victim itself or an authority confirmed the incident.
September 2025
Brussels Airport (through its provider Collins Aerospace)
Attack on a providerData leak not confirmedRestoredCyberattack on Collins Aerospace, the provider of check-in and boarding systems: a number of flights cancelled between 20 and 28 September 2025, the vast majority operated thanks to alternative systems.
- Data :
- The source used does not mention data.
- Recovery :
- New check-in and boarding system fully rolled out, according to the airport (09/10/2025).
- victim · Brussels Airport, 09/10/2025 : 2.3 million passengers at Brussels Airport in September, an increase of 1%
July 2025 · announced 20/08/2025
Orange Belgium
Unauthorised accessData leak confirmedRestoredCyberattack detected at the end of July 2025 on an IT system, giving unauthorised access to data from 850,000 customer accounts. Access blocked on detection, complaint filed. BIPT points to a higher risk of SIM card fraud and approved an extra SMS check by Orange before any number transfer.
- Data :
- Name, first name, phone number, SIM card number, PUK code, tariff plan; no passwords, email addresses or bank details, according to Orange.
- Recovery :
- Access to the affected system blocked on detection.
- victim · Orange Belgium, 20/08/2025 : Orange Belgium informe ses clients d'une cyberattaque
- authority · BIPT, 29/08/2025 : Beschermende maatregel volgend op datalek Orange (persbericht)
September 2021
A Belgian hospital (name withheld by the Data Protection Authority)
RansomwareData leak confirmedRestoredRansomware through the mail server: Windows servers locked and a ransom demand. Emergency department closed for 3 days (patients redirected); patient records 95% operational three days later. It was the hospital's second ransomware attack in two and a half years.
- Data :
- About 5 gigabytes of information exported by the attacker, according to the DPA Inspection Service (facts not disputed by the hospital).
- Recovery :
- Consequences largely resolved after about 12 days, according to the hospital.
- authority · Autorité de protection des données (Chambre contentieuse), 17/12/2024 : Beslissing ten gronde 166/2024 van 17 december 2024 (partiellement annulée en appel le 3/09/2025, sur l'amende)
13/01/2020 · announced 14/01/2020
Picanol Group (Ypres)
RansomwareData leak not confirmedRestoredLarge-scale ransomware attack: operations seriously disrupted in Ypres, Romania and China, production halted, share trading suspended.
- Data :
- The press releases do not mention a leak.
- Recovery :
- Production gradually restarted from 20/01/2020; cost estimated at under one million euros (press release of 31/01/2020).
- victim · Picanol Group, 14/01/2020 : Press release
- victim · Picanol Group, 31/01/2020 : Press release: cyber attack, update January 31, 2020
Computer crime recorded by the police
Offences recorded by the police (police crime statistics, Federal Police), category "Computer crime". These are recorded offences, not victims or attacks on organisations: computer fraud makes up most of it.
| 2015 | 2016 | 2017 | 2018 | 2019 | 2020 | 2021 | 2022 | 2023 | 2024 | 2025 | |
|---|---|---|---|---|---|---|---|---|---|---|---|
| Belgium | 18,074 | 20,833 | 21,605 | 25,647 | 35,101 | 44,864 | 48,958 | 60,619 | 63,000 | 67,319 | 73,290 |
| Brussels-Capital Region | 3,585 | 4,144 | 4,253 | 4,127 | 5,143 | 4,803 | 5,993 | 8,690 | 9,351 | 9,451 | 9,009 |
| Flemish Region | 6,992 | 7,838 | 8,932 | 12,461 | 18,371 | 29,342 | 30,233 | 33,863 | 33,938 | 36,025 | 42,496 |
| Walloon Region | 7,497 | 8,851 | 8,420 | 9,059 | 11,587 | 10,719 | 12,732 | 18,066 | 19,711 | 21,843 | 21,785 |
Breakdown by sub-category · 2025
| Belgium | Brussels-Capital Region | Flemish Region | Walloon Region | |
|---|---|---|---|---|
| Computer fraud | 61,068 | 8,418 | 32,964 | 19,686 |
| Hacking | 7,454 | 353 | 5,672 | 1,429 |
| Computer forgery | 4,412 | 186 | 3,653 | 573 |
| Sabotage | 356 | 52 | 207 | 97 |
| Computer crime (total) | 73,290 | 9,009 | 42,496 | 21,785 |
Incidents reported to the Centre for Cybersecurity
Figures published by the Centre for Cybersecurity Belgium (CCB), as is, with the source page. They count notifications received, not all attacks: the increase also reflects the reporting duty introduced by the European NIS2 directive.
- 144Account compromises (most reported threat)(2025)
- 556of which cyber incidents(2025)
- 103CCB emergency response operations (incl. forensic support)(2025)
- 635Incident notifications received by the CCB(2025)
- 105Ransomware incidents(2025)
- 109Ransomware incidents(2024)
- 32,005Targeted warnings sent to organisations(2025)
Centre pour la Cybersécurité Belgique (CCB), 26/03/2026 : More attacks, more reporting: Belgium's cyber reality in 2025
- 116Cyber incident notifications, 4th quarter(2024-T4)
- 74Cyber incident notifications, 4th quarter(2023-T4)
Centre pour la Cybersécurité Belgique (CCB), 19/02/2025 : NIS2 puts companies in motion: cybersecurity and reporting get a boost
Sources and limits
- Each incident cites at least one source from the victim or an authority, with its date. An incident known only from the press is not shown, even if likely.
- "Data leak not confirmed" means the official source does not announce one, not that there was none. Ransom amounts and claims by criminal groups are not included: they do not come from the victims.
- An attribution is only mentioned if the government, an authority or the victim made it publicly, in their words.
- Police figures are recorded offences and depend on complaints. They measure neither the number of victims nor the severity of attacks.
- Police crime statistics : police.be/statistiques · data as of 24/04/2026