Belgian municipality shuts multiple online services following a cyber attack

The municipality of Herselt in Belgium suffered a cyber attack that has caused serious disruption to its services.

The municipality said in a notice posted to its website on April 5 that it was hit by a cyber attack that had severed the internet connection from its computers. While the impact of the security incident did not appear to be significant at first, the City said that its data appeared to be safe and the internal servers were thoroughly examined by experts.

“Our municipal services in VTC de Mixx, the library, the town hall, and the OCMW are closed this week. We will probably be able to restart our services on Tuesday,” the City said.

In a fresh update, the City revealed that threat actors gained access to the municipal server by exploiting a third-party software supplier and that its own security supplier wasn’t breached. The City also added that it is working with external cyber security experts to investigate the incident and trying to understand the nature and scope of the cyber attack.

“The attack is causing serious disruption to our services, we cannot guarantee that we will be operational again by Tuesday, but we are looking at alternative locations for our essential services.

“Our municipal services in VTC de Mixx, the library, the town hall, and the OCMW will remain closed this week,” the City added.

Mayor Peter Keymeulen (N-VA) said that there is so far no evidence of any data being stolen from the breached servers, but the possibility of the same cannot be ruled out.

“In order to be able to conduct that investigation, we immediately opted for the most drastic measure. We have closed everything and will systematically release functions when it is clear that everything is in order,” he said.

So far, no threat actor has claimed responsibility for the cyber attack on the municipality of Herselt and the City hasn’t received any ransom demands yet.

Last year, Digipolis, the IT partner of the city of Antwerp, Belgium, also suffered a cyber attack that crippled its daily operations. Threat actors targeted Digipolis between December 5th and December 6th and disrupted several citizen-oriented services. These included appointments with the Population Service or recording visits to the container park. Citizens, could, however, use the emergency helpline numbers 101 and 112 to contact the police or call the fire brigade but the e-forms of the fire brigade were unavailable.

The Play ransomware gang claimed responsibility for the cyber attack on Digipolis and listed Antwerp as one of its victims on its data leak site. According to a screenshot shared by threat analyst Brett Callow, the gang reportedly stole 557 GB of data from the Belgium city, including sensitive personal information such as passports, identity cards, and financial documents.