Belgium: 47 entities hit by data breaches in 2026 (24/10/2026)
Dark web monitoring, confirmed by the Centre for Cybersecurity Belgium, counts at least 47 Belgian entities hit by a data breach since January 2026. Incident reports received by the CCB have already passed the full-year 2025 total. Here is the useful reading for an SME in our four countries, plus the list to clear this week.
In short
On 24 October 2026, a Belga news dispatch published the result of dark web monitoring by the newspaper L'Echo, cross-checked with that of the firm Fox&Fish Cyberdefense: at least 47 companies and institutions operating in Belgium have suffered a data breach since the start of 2026[1]. The Centre for Cybersecurity Belgium (CCB) confirms the finding; it had counted 40 affected entities across the whole of 2025[1]. Municipalities, hospitals, travel agencies and private companies are among the victims, which means SME-sized organisations, not only large accounts.
Two counts, one acceleration
Two sets of figures are circulating this week, and they do not measure the same thing. The first is the L'Echo-Fox&Fish monitoring: 47 entities in 297 days, from 1 January to 24 October, which is one organisation exposed every 6.3 days. The CCB count for 2025 gave 40 entities over 365 days, one every 9.1 days[1]. The second set comes from the CCB itself, in its 15 October update: 588 incident reports received between 1 January and 28 September 2026, while the whole of 2025 had stopped at 556[2]. Per day, those 588 reports work out at 2.17 against 1.52 in 2025, a 42% higher rate.
| Measure | 2025, full year | 2026, to date |
|---|---|---|
| Belgian entities hit by a breach (L'Echo-Fox&Fish monitoring, confirmed by the CCB)[1] | 40 in 365 days, one every 9.1 days | 47 in 297 days, one every 6.3 days |
| Incident reports received by the CCB[2] | 556 in 365 days, 1.52 per day | 588 by 28 September, 2.17 per day |
The rates above are CyberNovaLabs.io calculations from the two sources; the totals themselves are published figures. At a constant rate, reports received by the CCB would end the year near 790, which is our projection and not an announced number.
System compromise and suppliers: the two engines
The CCB publishes these figures in its third-quarter 2026 report, titled Stormy Weather. System compromise is the most frequently reported incident type there, with reports tripling compared with the second quarter[2]. The centre names two amplifiers: vulnerabilities in widely used software, and incidents hitting a supplier that expose several of its customers at once. It adds that artificial intelligence speeds up the attacker's work, from finding flaws to drafting convincing fraudulent messages and automating entire stages of an attack, while it can equally serve the defence[2].
That second engine is the one SMEs underestimate most: you can be a victim without having been attacked. We set it out in detail in our analysis of the Albert Heijn shutdown seen from a supplier's side. And the entry point is often more ordinary than expected: at Flink, one former employee's login was enough.
What it changes for an SME in practice
Leaked data is rarely spectacular taken item by item: names, dates of birth, account numbers, phone numbers, addresses, sometimes family photos. It is resold for a few hundred euros on the dark web and, cross-referenced, it allows criminals to target a specific person and win their trust, usually through phishing[1]. For an SME the consequence is operational: your staff will receive messages containing genuine information about them, about your customers or about your invoices. The instruction beware of strange emails no longer protects anyone, because the message is no longer strange.
The second consequence is the clock. Once a personal data breach is established, Article 33 of the GDPR requires notification to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to individuals; Article 34 adds communication to the people concerned where the risk is high[3]. Those 72 hours do not start when your investigation ends: they start when you know. The internal breach register, also set out in Article 33, is what lets you show the deadline was met[3].
The four countries: who you notify after a data breach
The GDPR is a regulation, so the principle and the deadline are identical in the Netherlands, Belgium, France and Luxembourg. What changes is the desk.
| Country | Data protection authority |
|---|---|
| Belgium | Data Protection Authority (APD / GBA) |
| Netherlands | Autoriteit Persoonsgegevens (AP) |
| France | CNIL |
| Luxembourg | CNPD |
Do not confuse two channels. GDPR notification concerns personal data. Entities within the scope of NIS2 additionally have an incident report specific to that regulation, to the competent national authority and with its own deadlines: we set out the scope country by country on our NIS2 Belgium page and in our cybersecurity offer. An SME outside the scope of NIS2 is still bound by the GDPR.
The priorities the CCB puts forward
In the same publication, the CCB asks business leaders to designate, without delay, the people responsible for eight measures: enable multi-factor authentication, giving priority to email, administrator accounts and remote access, and favouring phishing-resistant methods; fix internet-exposed vulnerabilities, prioritising those actively exploited, then verify the fix is genuinely deployed; catalogue what is reachable from the internet and cut that exposure to the bare minimum; put monitoring and an immediate response capability in place; protect essential backups and make sure data really restores; train staff to recognise suspicious messages and to verify any unusual payment request through another channel; decide in advance who decides, who to call and how essential operations continue; and finally assess the case for cyber insurance, reading the cover and the exclusions, the CCB noting that it complements security measures rather than replacing them[2].
Two free tools go with that list: the Safeonweb at Work self-assessment, to set first priorities[4], and the CyberFundamentals framework to structure the measures[2].
- Enable multi-factor authentication on email and administrator accounts, then check that no remote access is exempt.
- List the accounts of everyone who left in the past twelve months, employees, interns and contractors included, and close them.
- Write on a single page who notifies the authority, with what wording, within what deadline, and where the breach register sits.
- Test a backup restore on a real folder, not on a test file.
- Ask your three most sensitive suppliers one plain question: within how many hours do you tell us if your systems are compromised? Our supplier security questionnaire gives you the base.
- Warn your teams that phishing attempts will now contain accurate details, and set the rule: any payment request or bank account change is verified by phone, on a number you already know.
At CyberNovaLabs.io
We work with SMEs in the Netherlands, Belgium, France and Luxembourg, including in Brussels, and we always start with the same question: if a breach became public tomorrow, who decides, who notifies, and within what deadline? If the answer does not fit on one page, that is the first job. Let's go through your case in twenty minutes and you leave with the three measures that cut your exposure most. Our work is quoted on request.
Sources
- Des centaines de milliers de Belges touches par des fuites de donnees - Belga / La Libre, 24/10/2026
- Figures show a steady rise in incidents: the CCB urges enterprises to act immediately - Centre pour la Cybersecurite Belgique (CCB), 15/10/2026
- Reglement (UE) 2016/679 (RGPD), articles 33 et 34 - EUR-Lex
- Safeonweb at Work - auto-evaluation gratuite (CCB)
Qualified meetings, no lock-in.
Criteria in writing before launch, pay per meeting or monthly, stop with a simple email.
Read next
Belgian tax portal attacked: deadline moved (28/10/2026)
Four days without MyMinfin, Tax-on-Web or Biztax, and a filing deadline that did not move. No data was stolen, so the cost sits elsewhere. What the Belgian tax portal cyberattack changes in practice for an SME in Belgium, France, the Netherlands and Luxembourg.
Read the article →November 3, 2026 · 9 min readAI Act 2026: what SMEs actually need to know
Applicable since 2 August 2026, the AI Act comes down to three duties for an SME that buys AI. The heavy Annex III rules now wait until 2 December 2027. Here are the dates, the fine ceilings that actually apply to an SME, and who enforces in the Netherlands, Belgium, France and Luxembourg.
Read the article →October 27, 2026 · 7 min readB2B cold call script: a framework that doesn't sound scripted
A recited script is audible in the first second. Here is a six-block framework with one mandatory sentence per block, the wording the authorities require in four countries, and the formula that tells you how many calls fill a diary.
Read the article →October 27, 2026 · 8 min readNIS2 Belgium: are accounting firms and fiduciaries in scope?
Accounting appears in neither Annex I nor Annex II of the Belgian Act of 26 April 2024. But a fiduciary that runs its clients' IT can become a managed ICT service provider, and every firm feels the supply chain pressure of its in-scope clients.
Read the article →October 26, 2026 · 8 min readNIS2 Netherlands: is your manufacturing plant in scope?
In the Netherlands NIS2 is called the Cyberbeveiligingswet, in force since 15 August 2026. For a factory the test is not "we make things": six precise Annex II categories decide, then company size. This guide gives the grid, the regulator, the registration desk and the reporting clock.
Read the article →October 25, 2026 · 8 min readNIS2 France: are healthcare providers and labs in scope?
Health sits in Annex I of NIS2, yet no NIS2 obligation is enforceable in France on 25 October 2026. Meanwhile a separate French decree already requires five categories of care providers, medical labs included, to report incidents without delay. Here is which, and what to do.
Read the article →