Belnet, the Belgian government and research network, confirms a supplier zero-day let attackers copy all incoming mail to Belnet-owned domains and the transfer links its FileSender and FedSender services sent directly for 65 days
A national research and government network had its mail copied for 65 days through a zero-day in Fortinet technology
Analysis
Belnet identified the incident on 2026-09-24 and says an attacker exploited a zero-day in technology from its external supplier Fortinet; the vulnerability was remediated on 2026-09-25 at 08:10 (Belnet, 2026-10-02). Belnet says Fortinet has published technical information about the vulnerability, including the CVE, and links Fortinet's advisory FG-IR-26-175 without naming the product (Belnet, 2026-10-02); that advisory covers a FortiMail path traversal that Fortinet reports exploited in the wild (Fortinet PSIRT, 2026-10-01). Between 2026-07-22 and the morning of 2026-09-25, a window of 65 days, the attackers copied to external infrastructure all incoming mail to Belnet-owned domains (for example guest-roaming and BNIX addresses) and every download link its FileSender and FedSender services generated and sent directly, which could let them fetch the transferred files; password-protected or authenticated transfers are described as unreadable unless the password was written in the upload comment, and Risky Bulletin adds that mail sent to one of its customers was also stolen (Belnet, 2026-10-02; Risky Bulletin, 2026-09-30).
Cited evidence
On 24 September 2026, Belnet identified a security and privacy incident within its IT infrastructure.
The incident was caused by the exploitation of a zero-day vulnerability affecting technology provided by our external supplier Fortinet.
During the affected period, emails were copied by the attackers and transferred to external infrastructure.
At this stage, no further information is available regarding the identity or affiliation of the threat actor responsible for the incident.
Updates1
Belnet's incident notice, updated on 2026-10-02 at 11:00, now names the external supplier as Fortinet and links Fortinet's advisory FG-IR-26-175 (Belnet, 2026-10-02). Belnet also says it engaged the Centre for Cybersecurity Belgium for incident response and forensics, and that on 2026-09-29 it removed download links that were still active and disabled transfers created during the affected period, which generated notifications to senders and recipients (Belnet, 2026-10-02). Senders who still need to share the files must create new transfers, because Belnet cannot recreate them, and Belnet still names no actor (Belnet, 2026-10-02).
Sources3
Revision history
- Published 2026-10-02T0404Z-intel
- Update 2026-10-03T0404Z-intel
Belnet's notice, updated 2026-10-02, now names the supplier as Fortinet and links Fortinet's advisory FG-IR-26-175, says the Centre for Cybersecurity Belgium is assisting, and says transfers created in the affected period were disabled on 2026-09-29, so senders who still need to share the files must create new transfers.
Changed: headline summary priority sources evidence sourcing_note references body
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.