CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Machelen municipality cyber incident (September 2026)

incident · incident:machelen-municipality-cyberincident-2026-09 single-source-victim

Belgian municipality whose own timeline shows attackers gaining access to an internal laptop through misleading instructions on an external website on 2026-08-20, reaching a high-privilege user on 2026-09-10 and being found on 2026-09-11, with personal data confirmed stolen; Ransomware.live recorded on 2026-10-27 that Rhysida had listed the municipal and social-welfare file servers on its leak site, a claim the municipality has not confirmed (Machelen municipality, 2026-10-27).

Aliases: Machelen cyber incident

Coverage
1
first 2026-10-29 → last 2026-10-29
Latest activity
2026-10-29
Machelen municipality: foothold from a website's misleading instructions, 22 days to detection; Rhysida lists…
Peak priority
routine
1 routine
Targets
public-sector
sectors: public-sector · regions: europe
Sources cited
4
3 hosts

Defender insights

What each entry about Machelen municipality cyber incident (September 2026) tells a defender to do, newest first.

2026-10-29ROUTINEMachelen municipality: foothold from a website's misleading instructions, 22 days to detection; Rhysida lists its files

Detection

Relationships explore in graph

Typed, source-stated connections from the entity registry; each edge cites the entry whose reporting establishes it.

attributed to

Story timeline

  1. 2026-10-29Machelen (Belgium) municipality: its own timeline shows a foothold through misleading instructions on an external website on 2026-08-20, found 22 days later after a high-privilege user was reached, with personal data confirmed stolen and Rhysida now listing municipal and social-welfare files
    active-threatsMachelen municipality: foothold from a website's misleading instructions, 22 days to detection; Rhysida lists its files

Hunting pivots

Tags
data-breachransomware
ATT&CK techniques (1 across 1 tactic)

1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • ExecutionUser Execution

Execution TA0002

T1204User Execution×1

An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of Phishing.

Evidence: 2026-10-29/machelen-municipality-misleading-instructions-rhysida · ATT&CK page ↗

Entries about Machelen municipality cyber incident (September 2026) (1)

2026-10-29 · view entry permalink →

ROUTINENATOA2

Machelen (Belgium) municipality: its own timeline shows a foothold through misleading instructions on an external website on 2026-08-20, found 22 days later after a high-privilege user was reached, with personal data confirmed stolen and Rhysida now listing municipal and social-welfare files

Machelen's own timeline records that on 2026-08-20 attackers gained access to an internal laptop through misleading instructions on an external website, explored it extensively from 24 August to 1 September, and on 10 September had access to a user with high access rights and other IT systems; the municipality found the incident on 11 September, isolated all systems, reported to the Belgian CCB-CERT, restarted part of its systems from a backup of a safe date on 14 September and recorded the first evidence of leaked data on 17 September (Municipality of Machelen, 2026-09-22). It confirms that personal data was leaked and says the scope is still being investigated (Municipality of Machelen, 2026-09-22); the mayor had said on 14 September that no personal data appeared to be affected, and ITdaily reports that this proved wrong (ITdaily, 2026-09-23). Ransomware.live recorded on 2026-10-27 that Rhysida listed Machelen on its leak site, describing the listing as municipal and social-welfare file servers of about 1.3 million files, with client files that include passports and identity cards, nursing-home medical files and civil-status records, which are the group's own claims (Ransomware.live, 2026-10-27).

hackers gain access to an internal laptop through misleading instructions on an external website (translated from Dutch)

hackers have access to a user with high access rights and other IT systems within the organisation (translated from Dutch)

Municipality of Machelen (incident timeline) 2026-09-22

We can confirm that personal data has been leaked. (translated from Dutch)

Municipality of Machelen (FAQ on personal data) 2026-09-22
incident29 Oct 04:44Zsingle-source · victim disclosureOpen finding →
Sources: Municipality of Machelen (incident timeline) · Municipality of Machelen (FAQ on personal data) · ITdaily · Ransomware.live

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Threats1

Source distribution

  • machelen.be2 (50%)
  • itdaily.com1 (25%)
  • ransomware.live1 (25%)
All cited sources (4)