The biggest cyber attacks in Belgium (2020–2026)

In brief: The biggest cyber attacks in Belgium since 2020 hit a research network, two cities, the Ministry of Defence, hospitals, a brewer, a telecom operator and the national airport. The most expensive was the ransomware attack on the city of Antwerp in December 2022, which the city itself estimated at around €70 million. The pace is still rising: the Centre for Cybersecurity Belgium (CCB) received 588 incident reports between January and September 2026, more than in all of 2025. Below are the twelve best documented cases, what they have in common and what they mean for Belgian organizations under the NIS2 law.

The biggest attacks at a glance

Timeline: the attacks that shaped Belgian cybersecurity

2021: Belnet, Liège and the Ministry of Defence

On 4 May 2021 a DDoS attack saturated Belnet, the government-funded network that connects Belgian universities, research institutes and public administrations. Around 200 institutions lost their connection. Committee meetings in the federal parliament were cancelled and the COVID-19 vaccination booking site went down with it.

A month later the city of Liège announced it was the victim of “a large-scale targeted computer attack”. Belgian media pointed to the Ryuk ransomware group, which the city never confirmed. Emergency recovery took six weeks, full recovery six months, the head of its IT department later told RTBF.

On 16 December 2021 attackers used the Log4j vulnerability to get into the network of the Ministry of Defence. The network was cut off from the internet for weeks. Minister Ludivine Dedonder later put the direct cost at €2.25 million. The attack is attributed to state-backed hackers from China.

2022: Vivalia and the city of Antwerp

In mid-May 2022 ransomware encrypted the systems of Vivalia, a group of seven hospitals and six residential care centres. LockBit claimed the attack and threatened to publish 400 GB of patient and staff data. Seven weeks later the hospitals still could not reach all of their patient data.

The attack Belgians remember best came in the night of 5 to 6 December 2022. The Play ransomware group hit the IT environment of the city of Antwerp, run by its ICT organization Digipolis, and claimed more than 500 GB of data. Almost every city service went down. The city says it did not pay, and a month later estimated the bill at around €70 million in costs and lost income. In June 2024 the Flemish supervisory commission for personal data delivered a hard verdict, reported by VRT NWS: missing security updates, insufficient two-factor authentication, a barely segmented network and hardly a recovery plan.

2023 and 2024: Limburg.net and Duvel Moortgat

In December 2023 the Medusa group broke into Limburg.net, the waste management company of the Limburg municipalities. It demanded €100,000. Limburg.net refused and the data was leaked. The final analysis by EY in June 2024 counted 292,734 victims, mostly names and addresses with national register numbers.

In the first week of March 2024 an alarm went off at Duvel Moortgat and the servers were shut down. Production at the brewery in Puurs-Sint-Amands stood still until bottling resumed on 7 March. The brewer’s public message was dry: there was enough beer in stock for everyone.

2025: the Walloon administration, Orange Belgium and Brussels Airport

In April 2025 intruders got into the IT systems of the Service public de Wallonie, the administration of the Walloon Region. On 17 April it decided, together with the CCB, to cut every internet connection. The disruption was serious enough for a decree of 15 May 2025 to extend legal deadlines in Walloon legislation by 60 days.

At the end of July 2025 Orange Belgium detected an intruder in a system holding data of 850,000 customer accounts: names, phone numbers, SIM card numbers, PUK codes and tariff plans. It disclosed the breach on 20 August.

On the evening of 19 September 2025 an attack on Collins Aerospace took out the check-in and boarding software at Brussels Airport. The airport asked airlines to scrap about half of the 276 departures planned for the following Monday. The EU cybersecurity agency ENISA confirmed that ransomware was the cause.

2026: AZ Monica and one portal that opened 270 doors

On 13 January 2026 the Antwerp hospital AZ Monica shut down all servers at its two campuses after a cyber attack. Operations were cancelled, about 70 patients were sent home and seven were transferred to other hospitals. The electronic patient record came back three weeks later.

In June 2026 the Belgian security firm Secutec warned about a campaign that had been running since February. Attackers had brute-forced accounts on Fortinet’s partner portal and stolen firewall credentials from IT service providers. At least 270 Belgian organizations were affected. The pattern is not uniquely Belgian, as our overviews of the biggest attacks in the Netherlands, France and Germany show.

What the Belgian cases have in common

• Public services and healthcare take the heaviest blows. Two cities, a regional administration, a ministry and two hospital groups: their damage is counted in weeks of downtime, not in ransom.
• Ransomware dominates, and data theft comes with it. At Vivalia, Antwerp and Limburg.net the attackers used stolen data as leverage. The CCB counted 80 ransomware attacks in the first nine months of 2026.
• The way in is rarely a brilliant hack. Where the entry point is known, it is an unpatched vulnerability (Defence), stolen login details (the Fortinet campaign) or missing basics such as two-factor authentication (Antwerp). Reports of compromised accounts to the CCB went from 72 in 2024 to 144 in 2025 and 156 in the first nine months of 2026.
• Suppliers pull you in. Brussels Airport was not attacked itself, its software supplier was. In 2026 one vendor portal exposed hundreds of Belgian networks.

What the CCB and Safeonweb do

The Centre for Cybersecurity Belgium (CCB) is the national cybersecurity authority and runs the national incident response team. It receives incident reports, supervises the NIS2 law and publishes CyberFundamentals, a framework of security measures in levels. Companies find its tools and the NIS2 registration on Safeonweb@Work.

Safeonweb is the public side. Anyone can forward a suspicious message to [email protected]. In 2025 the CCB received 27,000 of those a day on average, and by March 2026 more than 42,000. Miguel De Bruycker of the CCB told VRT NWS that AI now lets criminals produce very credible messages in no time.

The human factor: where an attack really begins

Belgian victims seldom publish how the attackers got in, so nobody can honestly claim that every case above started with a phishing email. The figures do show where the pressure sits: tens of thousands of phishing messages a day, twice as many compromised accounts as two years ago and stolen login details at the heart of the largest campaign of 2026.

No firewall covers that part. An employee who recognises a fake login page or a call from “the helpdesk” stops an attack before it becomes an incident. Our overview of types of phishing attacks shows what such messages look like today. Guardey trains this reflex with a gamified challenge of about three minutes every week, with phishing simulations included.

What this means for Belgian SMEs under the NIS2 law

Belgium transposed NIS2 on time. The law of 26 April 2024 has applied since 18 October 2024, with the CCB as supervisor. Medium-sized and large organizations in the listed sectors must register, report significant incidents within 24 and 72 hours and take risk management measures, which include cybersecurity training. Management has to follow training itself and is liable. Fines run up to €10 million or 2% of worldwide turnover. Our NIS2 guide explains the scope, the duties and the deadlines.

Four lessons any Belgian SME can act on this quarter:

1. Switch on multi-factor authentication and patch fast. Weak two-factor authentication was a finding in Antwerp, an unpatched system the way into Defence.
2. Ask your suppliers the Brussels Airport question. Who holds your login details and critical software, and what do you do when they go down?
3. Rehearse the recovery. Duvel was bottling again within days, Liège needed six months. See also how to prevent ransomware.
4. Train people every week, not once a year. Short, regular training and simulations keep attention high and give you the evidence an auditor asks for.

Frequently asked questions

What was the biggest cyber attack in Belgium?

By cost, the ransomware attack on the city of Antwerp in December 2022, estimated by the city at around €70 million. By number of people affected, the Orange Belgium breach of 2025 with 850,000 customer accounts. By reach, the Belnet DDoS of May 2021, which cut off around 200 institutions at once.

How many cyber attacks are there in Belgium each year?

The CCB received 372 incident reports in 2024, 556 in 2025 and 588 in the first nine months of 2026. Those are only the incidents that organizations report.

Where do you report a cyber attack in Belgium?

Organizations that fall under the NIS2 law must report a significant incident to the CCB, with an early warning within 24 hours. Suspicious messages can be forwarded to [email protected].

Does the Belgian NIS2 law apply to SMEs?

It applies to organizations in the listed sectors with at least 50 full-time employees, or with a turnover and balance sheet total above €10 million. The details are in our NIS2 guide.