Executive Summary
An eSignFlow data breach at Belgian software supplier Vanden Broele gave an outside attacker access to signing data from a large share of the organisations using the platform including Belgian municipalities. The intrusion ran from 03:48 on 22 October 2026 until 11:17 the next day. Vanden Broele took eSignFlow offline on 23 October and brought it back with new keys on the evening of 24 October. On its incident page, last updated on 27 October, the company tells customers to assume the attacker knows signers’ national register numbers, correcting an earlier letter that called them hashed. It has reported the incident to the Centre for Cybersecurity Belgium (CCB), the Data Protection Authority (GBA) and the police. No ransom was demanded.
How the eSignFlow Breach Ran for 31 Hours
Vanden Broele’s incident page says the attacker came in through a management environment that could be reached from the internet. Stolen keys then let the intruder pose as users through the eSignFlow API and pull data from inside the application. eSignFlow is the company’s platform for routing documents to be signed digitally, used by local authorities and businesses.
Staff spotted the activity at 09:30 on 23 October. The attack kept running until 11:17 and the platform went offline around midday.
The intruder also tried other routes including underlying servers and eGovFlow, another Vanden Broele application. The company says eGovFlow itself was not breached. Personal itsme accounts and Belgian eID cards were not touched, it says. External Active Directory environments saw no impact.
Register Numbers Were Hashed but Easy to Reverse
Vanden Broele sorts the exposed people into groups. For signers, internal and external, that means name, country and national register number plus an image of a handwritten signature in a limited number of cases. For people listed in document data it means name, email address, document title and access code which made the documents themselves reachable. At a small number of organisations the attacker downloaded full documents. Customer users had names and email addresses exposed but no passwords. Staff, elected officials and suppliers are among those exposed, not only residents.
A letter sent to part of the customer base on 25 October said the numbers were hashed. The incident page now says that form is easy to calculate back. On 26 October chief executive Bram Van Impe had described the leak as mostly metadata such as signer names and document titles.
The company says nobody signed a document in another person’s name.
Municipalities Decide Who Gets Told
Vanden Broele notified the CCB on 23 October and the GBA on 25 October for data it controls itself. For data inside eSignFlow it acts as processor. Each customer decides whether to inform the people concerned and whether to report to the GBA, the Flemish supervisory commission or, if it falls under NIS2, the CCB.
The municipality of Mol warned residents on 27 October to watch for suspicious emails, texts, calls and payment requests, adding that the consequences for the municipality were not yet confirmed. Dessel issued a similar warning and listed the only bank accounts that appear on its administrative fines.
Vanden Broele’s general terms, valid from 1 January 2024, exclude liability for damage from third-party fraud such as hacking unless it stems directly from the company breaching its legal or contractual duties. They cap liability for any one incident at the fees the customer paid in the three full months before the month it occurs.
Open Until the 9 November Root-Cause Report
Vanden Broele hasn’t given a count of the organisations or people hit by the eSignFlow data breach. It hasn’t explained how the management environment came to be reachable from outside or named the attacker. A root-cause analysis for every attack route is due in the week of 9 November.
IMY’s Miljödata Fine Cited Missing Intrusion Monitoring
Sweden’s privacy regulator has already fined a software supplier over a breach of this kind. On 22 September 2026 the Swedish Authority for Privacy Protection (IMY) ordered Miljödata to pay SEK 1.8 million under GDPR Article 32.1 after an August 2025 breach that exposed sick-leave and school incident records. IMY cited the lack of automatic real-time monitoring for intrusions. Vanden Broele’s timeline puts the eSignFlow intruder inside for 29 hours and 42 minutes before staff noticed. The attack then ran for another hour and 47 minutes.
References
- Veelgestelde vragen incident oktober 2026
- Algemene voorwaarden vanaf 01/01/2024
- Cyberaanval bij leverancier digitale handtekeningen: wees alert voor verdachte berichten
- Beveiligingsincident bij eSignFlow: wees alert voor phishing
- Sanktionsavgift mot Miljödata för bristande säkerhet
- Published report, 26 October 2026
This post is also available in:
Svenska
