Machelen (Belgium) municipality: its own timeline shows a foothold through misleading instructions on an external website on 2026-08-20, found 22 days later after a high-privilege user was reached, with personal data confirmed stolen and Rhysida now listing municipal and social-welfare files

Machelen's own timeline records that on 2026-08-20 attackers gained access to an internal laptop through misleading instructions on an external website, explored it extensively from 24 August to 1 September, and on 10 September had access to a user with high access rights and other IT systems; the municipality found the incident on 11 September, isolated all systems, reported to the Belgian CCB-CERT, restarted part of its systems from a backup of a safe date on 14 September and recorded the first evidence of leaked data on 17 September (Municipality of Machelen, 2026-09-22). It confirms that personal data was leaked and says the scope is still being investigated (Municipality of Machelen, 2026-09-22); the mayor had said on 14 September that no personal data appeared to be affected, and ITdaily reports that this proved wrong (ITdaily, 2026-09-23). Ransomware.live recorded on 2026-10-27 that Rhysida listed Machelen on its leak site, describing the listing as municipal and social-welfare file servers of about 1.3 million files, with client files that include passports and identity cards, nursing-home medical files and civil-status records, which are the group's own claims (Ransomware.live, 2026-10-27).