TL;DR: What happened in the Vanden Broele cyberattack?
An intruder got into eSignFlow, the digital signature module of Belgian software supplier Vanden Broele, which more than 2,300 organisations, including more than 120 local authorities, use to have documents signed. The company spotted suspicious activity on Friday 23 October 2026, took the app offline by midday and closed the flaw on Saturday evening. Mostly metadata leaked (who signed which document), more in some municipalities, and towns such as Genk, Peer and Hasselt now warn residents about phishing and fake parking fines. For SaaS founders, this is a live case study of the first 72 hours after a breach, and of the scam wave that follows it.
Developing story. Last updated 27 Oct 2026, 22:35 CET. eSignFlow turns out to be far bigger than first reported: Vanden Broele says more than 2,300 organisations use it, and three more municipalities have warned residents (see the update below). We'll update this article as Vanden Broele, the municipalities and the Belgian authorities publish more.
The Vanden Broele cyberattack is why cyberattaque shot up in Belgian Google searches on Monday evening, a few hours after VRT NWS broke the story. One software vendor, one signature module, and more than a hundred town halls suddenly had to warn residents about scam messages. If you sell software that sits inside other organisations' workflows, read this one closely, because your customers will ask you the questions these municipalities are asking Vanden Broele right now.
What do we know so far about the Vanden Broele cyberattack?
Update 27 Oct, 22:35 CET: the company says more than 2,300 organisations use eSignFlow, according to Security.NL, so the software's reach is much wider than the 120-plus local authorities VRT first reported. Aarschot, Torhout and Mol have joined the towns warning residents. Torhout says staff email addresses may have been exposed and could be used for phishing, and Mol says the consequences for the municipality are not yet confirmed. The attack method, the attacker and the number of municipalities hit are still not public, and neither the CCB nor the data protection authority has commented.
Here is what Vanden Broele, its CEO and the municipalities have confirmed to Belgian media on 26 and 27 October:
Here is what Vanden Broele, its CEO and the municipalities have confirmed to Belgian media on 26 and 27 October:
- The product: eSignFlow is Vanden Broele's signature module. Municipalities and cities use it to have documents signed digitally, and it plugs into other public-sector software such as the GAS 5 fine service of C-Smart.
- The reach: more than 120 local authorities use the software, according to VRT, and more than 2,300 organisations in total, according to the company (Security.NL). How many were hit is still being investigated, and ITdaily reports the number "may still rise".
- The timing: per ICT Magazine, the intrusion took place on Thursday and Friday, 22 and 23 October. Vanden Broele noticed suspicious activity on its servers on Friday morning and took eSignFlow offline around midday.
- The fix: by Saturday evening the flaw was closed and the app was back online with some restrictions. The company closed the access the intruder used, replaced all access keys and connections to other systems, and blocked the attackers' known IP addresses.
- The reports: Vanden Broele informed the Centre for Cybersecurity Belgium (CCB), the Belgian data protection authority and the police, and promised every municipality its own impact analysis.
- The signatures: CEO Bram Van Impe says he is completely sure that no signatures were placed in anyone else's name.
What leaked, and who is warning residents?
Mostly metadata: the name of the person who signed a document, sometimes with the document's title. Van Impe told VRT that some documents can contain privacy-sensitive information, and that the situation differs greatly per municipality: in most of them little or nothing leaked, and in a smaller number more did. Genk and Hasselt say no residents' personal data leaked, while email addresses of some staff were exposed and certain documents were requested.
Genk, Peer, Hasselt, Steenokkerzeel, Leopoldsburg, Sint-Truiden, Beringen, Aarschot, Torhout and Mol have told residents to watch for unexpected emails, texts and calls asking for personal data, payment details, passwords or codes. The sharpest warning is about fake GAS 5 fines, the municipal fines for parking offences: residents should check that the account number matches their own municipality's. Peer put it plainly: "If in doubt: do not respond, do not click and do not pay. Check first." Steenokkerzeel residents have been unable to sign documents through eSignFlow since the weekend. Two partners issued their own statements: C-Smart said eSignFlow is a Vanden Broele product used by 19 local authorities in its GAS 5 service, and Cipal Schaubroeck said its own systems were not hacked.
What we don't know yet
- How many municipalities were hit, and which ones beyond the ten that have warned residents, and whether any of the other 2,300-plus organisations using eSignFlow were affected.
- How the intruder got in. No vulnerability, product version or attack method has been published.
- Who did it, and whether any ransom demand or data sale exists.
- Exactly what leaked per municipality, and how many residents' names and document titles are involved.
- What the remaining restrictions are on eSignFlow since it came back online, and when every municipality can sign normally again.
- What the CCB and the data protection authority say. Neither has commented publicly so far.
Timeline
- Thursday 22 and Friday 23 October 2026: the intrusion into eSignFlow (ICT Magazine).
- Friday 23 October, morning: Vanden Broele notices suspicious activity on its servers. Around midday it takes eSignFlow offline.
- Friday night and Saturday 24 October: investigation. On Saturday evening the flaw is closed and the app returns with restrictions.
- Monday 26 October, 16:59: VRT NWS publishes the story. Municipalities warn residents about phishing and fake GAS 5 fines, and cyberattaque starts trending in Belgium that evening.
- Tuesday 27 October: ITdaily and ICT Magazine report more municipalities warning residents; the per-municipality impact analyses are under way.
- Tuesday 27 October, late morning: Security.NL reports the company's figure of more than 2,300 eSignFlow user organisations. Aarschot, Torhout and Mol warn residents; Torhout says staff email addresses may have been exposed, Mol says the impact on the municipality is not yet confirmed.
Why is a signature module such an attractive target?
Because one vendor sits in the paperwork of a hundred customers at once. A signature tool knows who signs what, when and for which organisation, and it is wired into other systems through API keys and links, exactly the things Vanden Broele had to replace. Break in once and you see a slice of every customer's workflow. That is the same pattern we covered this week in the Cathedral and Anthropic story, where AI agents reached Anthropic's internal systems through third-party sales and admin software instead of Anthropic's own code.
Metadata sounds harmless until a scammer uses it. A list of names and document titles is enough to write a message that says "your signed parking fine is overdue, pay here" to the exact person who signed something last week. That is why the municipalities' first move was a phishing warning, before anyone knew the full scope.
What should SaaS founders copy from Vanden Broele's first 72 hours?
Let's break it down. On the facts published so far, the vendor did several things fast, and each one is something you can prepare before you ever need it:
- It noticed. Suspicious activity was spotted on the servers on Friday morning. If nobody reads your logs, a breach runs for weeks. Our guide to building security into startup operations from day one covers the logging basics.
- It pulled the plug the same day. eSignFlow went offline around midday. Decide now which feature you can switch off without killing the whole product, and who has the authority to do it on a Friday.
- It rotated everything. All access keys and connections to other systems were replaced. If your API keys, webhook secrets and partner tokens live in ten places, rotation takes days; the Railway and LiteLLM leaks showed what that costs.
- It reported to three bodies. The CCB, the data protection authority and the police. Know your reporting duties in advance (table below), because the clock starts when you become aware.
- It promised each customer its own analysis. A generic "we were hacked" email leaves every customer guessing. Per-customer impact reports need per-customer logs, so check today whether your logs can answer "which records of customer X were touched?"
And one gap the story exposes: residents and partners learned a lot through the press and town websites, and partners like C-Smart and Cipal Schaubroeck had to issue their own statements. If other companies embed or resell your product, write the partner briefing into your incident plan, so they hear it from you first.
Two details founders miss. Under GDPR Article 33, the processor's duty is to tell its customer "without undue delay", and the customer then has 72 hours to tell the regulator, so a slow vendor eats its customers' deadline. And under the Belgian NIS2 law of 26 April 2024, the CCB says the 24 and 72 hours are maximums: notify as soon as possible, and a NIS2 notice does not replace the GDPR notice to the data protection authority. NIS2 applies to companies in listed sectors with 50 or more staff or more than €10 million in turnover; whether Vanden Broele falls under it has not been reported.
What does the Vanden Broele cyberattack mean for you?
Next steps, depending on which side of the contract you sit:
- If you sell B2B software, write a one-page incident plan this week: who can take a feature offline, who rotates which keys, who calls which customer, and the exact sentence your CEO will publish.
- Map your secrets. List all your API keys, OAuth clients, webhook secrets and partner tokens, where each one lives and how to replace it in one hour.
- Make your logs answer customer questions. Per-customer audit logs turn a vague breach notice into a precise one, and precise notices keep contracts alive.
- Prepare the phishing warning in advance. After a breach, the scam wave arrives fast. Have a template that tells customers which channels you will never use to ask for money or passwords.
- Put breach timelines into your contracts. Our guide to vendor management for lean teams has the clauses; ask your own suppliers the same questions you'll be asked.
- Check your GDPR basics. Processor agreements, a breach register and named contacts are on the GDPR checklist for early-stage startups.
- Clean up old accounts. The Ogi Networks breach started with a forgotten test account. Old admin logins are the cheapest way in.
- If you are a customer of eSignFlow or a similar tool, ask your vendor in writing which of your records were touched and when, and log the answer for your own GDPR file. Fe/male Switch Foundation has the full customer-side plan: what a small business does in the first 72 hours after a supplier data breach, with a breach log and a customer warning template.
Are you getting customers from ChatGPT yet?
More and more traffic is coming from Perplexity, ChatGPT, Grok and other AI tools.
👉 Rank on ChatGPT
FAQ: the Vanden Broele cyberattack
What is eSignFlow?
eSignFlow is the digital signature module of Belgian software supplier Vanden Broele. More than 120 Belgian local authorities use it to have documents signed digitally (more than 2,300 organisations in total, the company says), and it connects to other public-sector software such as C-Smart's GAS 5 fine service.
Which municipalities were affected by the Vanden Broele hack?
The full list is not public. Genk, Peer, Hasselt, Steenokkerzeel, Leopoldsburg, Sint-Truiden, Beringen, Aarschot, Torhout and Mol have warned residents. Vanden Broele says the impact differs per municipality and most had little or nothing leaked.
What data leaked from eSignFlow?
Mainly metadata: the name of the person who signed a document, sometimes with the document title. Some documents can contain privacy-sensitive information. Genk and Hasselt say no residents' personal data leaked, though some staff email addresses were exposed.
Were any signatures forged?
Vanden Broele's CEO Bram Van Impe says he is completely sure no signatures were placed in anyone else's name.
How do I spot a fake GAS 5 fine?
Check that the account number matches your own municipality's official one, and open eBox messages only through the official My eBox environment. If in doubt, do not reply, click or pay, and contact your municipality directly.
What must a SaaS vendor do after a data breach in Belgium?
Under GDPR Article 33(2), a processor tells its customers without undue delay, and each customer has 72 hours to notify the data protection authority. Companies under the Belgian NIS2 law also send the CCB an early warning within 24 hours, a notification within 72 hours and a final report within a month.
About the Author
Violetta Bonenkamp, also known as MeanCEO, is an experienced startup founder with an impressive educational background including an MBA and four other higher education degrees. She has over 20 years of work experience across multiple countries, including 5 years as a solopreneur and serial entrepreneur. Throughout her startup experience she has applied for multiple startup grants at the EU level, in the Netherlands and Malta, and her startups received quite a few of those. She’s been living, studying and working in many countries around the globe and her extensive multicultural experience has influenced her immensely.
