Cyber attack forced Belgium's Public Centre for Social Action to take computer systems offline

The Public Centre for Social Action in Belgium suffered a cyber attack that forced the social service centre to take daily operations offline.

Belgian newspaper Sudinfo, which was the first to report about the cyber attack, said that the Public Centre for Social Action (CPAS) became a victim of a security incident earlier this week.

CPAS spokesperson Didier Neirynck told the publication that few of the services provided by the institution, such as the debt mediation service and Energy House service, were affected by the cyber security incident.

“The twelve social branches of the CPAS carolo were exceptionally closed to allow the implementation of all the procedures necessary to restore the situation. The debt mediation service, as well as the energy house were also inaccessible,” Neirynck said.

Neirynck clarified that not all of its internal systems were directly impacted by the cyber attack and that the organisation’s IT team had decided to take most of its systems offline to mitigate the risk of the attack. Neirynck added that nursing homes, citizen spaces, and home care centres were still operating and serving those in need.

As of now, CPAS is in the process of determining the nature and scope of the cyber attack. “We are busy taking stock of the damage. We are going to have to adapt our procedures to continue to fulfill all of our missions,” he added.

CPAS is expected to restart its operations on Monday, however, staff might need to switch to manual mode of operations and note things down manually rather than using a computer.

This is not the first time a humanitarian organisation has been targeted by threat actors. In January last year, the International Committee of the Red Cross (ICRC) announced that it suffered a significant cyber security incident that compromised the personal data and confidential information of more than 515,000 highly vulnerable people.

The affected people included victims of migration, disaster, and conflict, those in detection, and people who went missing and their families. ICRC also revealed that the stolen data originated from at least 60 Red Cross and Red Crescent National Societies globally.

ICRC said that what concerned it the most was that the leaked data, which could be shared publicly, belonged to members of a programme called Restoring Family Links that sought to reunite family members separated by conflict, disaster, or migration. As a result of this cyber attack, ICRC had to temporarily shut down the systems used to run the programme.