Rhysida leaks sensitive data from Belgian municipality Machelen

1. Executive summary

The Rhysida ransomware group listed the Belgian municipality of Machelen (Flemish Brabant) on its leak site on 2026-10-27, claiming theft of roughly 1.3 million files (about 2.9 TB) from municipal and OCMW social-welfare file servers, including a working copy and a backup copy. The claimed haul covers social-welfare and migration client files (passports, ID cards, residence permits, sick notes), WZC nursing-home medical and HR records, civil-status records carrying Belgian national register numbers (NISS/RRN), payroll and financial data, about 23,000 correspondence messages, and database backups. The group states it verified 13,319 files containing personal data, including a valid Belgian ID card with expiry 02/2029 and medical documents the listing itself places in the GDPR Article 9 special-category set. Rhysida has no MITRE ATT&CK profile, so the attribution to that group rests on the leak-site listing alone and is unconfirmed. No CVE, CVSS score, EPSS value or CISA KEV entry is associated with this item. For EMEA financial services the direct exposure is limited, but the case is a current worked example of double-extortion against a public-sector body holding identity documents and national register numbers, the same data classes banks hold on retail and onboarding customers.

2. Regulatory framing

No other article in the reference is engaged by a specific fact in this item.

3. Technical analysis & attack chain

The source is a leak-site listing, not an incident report. It gives the claimed contents of the stolen data and nothing about how the intrusion was carried out. The following is what the listing supports.

1. Rhysida claims access to Machelen's municipal and OCMW file servers and states it holds both a working copy and a backup copy (labelled lawer2 and lawer3).
2. The claimed data set is about 1.3 million files, roughly 2.9 TB, in Dutch with some French.
3. The group states it verified 13,319 files containing personal data. Named examples include a valid Belgian ID card expiring 02/2029, Belgian and Moroccan passports, national register numbers (RRN/NISS), sick notes with patient addresses, and medical documents the listing places in GDPR Article 9 special categories.
4. The claimed contents also include WZC nursing-home medical files, staff HR dossiers and workplace-accident records, civil-status records (births, marriages) with national register numbers, payslips and financial data, about 23,000 correspondence messages, employee home folders, and database backups: a full OCMW database backup (6 GB, 09/2026), 645 .mdb databases, 12,873 .dbf files and 110 .bak files (17 GB).

Initial access vector, exploited component, malware family, persistence, privilege escalation, command-and-control and lateral movement are not described in the source. No CVE is named. No ransom demand, negotiation status or proof-of-payment is stated. The listing does not say whether data was encrypted on the victim's systems or only exfiltrated; the presence of a "working copy + backup copy" in the group's possession is consistent with exfiltration, and the source does not confirm encryption.

The attribution to Rhysida rests on the leak-site post. Rhysida has no MITRE ATT&CK profile, and no independent source in this item corroborates the group's identity or the accuracy of its claims. Treat the file counts, the 13,319 verified figure and the data categories as the group's own assertions, single-sourced and unverified. The one detail that reads as a genuine artefact rather than a claim is the specific expiry date on the ID card (02/2029), which is the kind of value a group would only cite if it held the document.

4. Mitigation & containment

The item describes a third-party data exposure, not a compromise of client infrastructure. The actions below address the exposure paths it implicates.

P1 within 24h

• If your institution holds or exchanges data with Machelen or its OCMW, contact the counterparty to establish what of your data, if any, was in the exposed set, and record the answer.
• Search your own estate for the data classes named in the listing (national register numbers, scanned ID cards and passports, medical certificates) held outside an approved repository, and restrict access to what is found.
• Confirm that backups of any system holding citizen identity data are isolated from the production network and that a restore has been tested, given the 6 GB OCMW backup and 110 .bak files the group says it took.

P2 within 72h

• Where onboarding or KYC processes accept scanned Belgian ID cards or passports, add a manual review step for documents whose expiry falls after the exposure window, since a valid ID card expiring 02/2029 is now in criminal hands.
• Review identity-verification vendors' handling of national register numbers and require them to confirm they do not store full numbers where a tokenised form would do.

P3 within 7 days

• Add the Machelen exposure to your third-party risk register and, for any public-sector data-sharing agreement, confirm the counterparty's breach-notification clause covers this event.
• Brief fraud teams on the data classes exposed (identity documents, national register numbers, medical records) so retrospective fraud review can weight applications accordingly.

No vendor fix, patch or version applies to this item.

5. Indicators of compromise

No atomic indicators of compromise are available in the source material. The listing gives no hashes, domains, IP addresses, file paths or command lines. The only machine-relevant artefacts are the data categories and file counts the group claims, which are not indicators.

Behavioural indicators

6. Detection

Insufficient indicators to author detection rules.

7. Sources

• Ransomware.live, "Ransomware: rhysida named Machelen (Belgium) (BE)", https://www.ransomware.live/id/TWFjaGVsZW4gKEJlbGdpdW0pQHJoeXNpZGE=, published 2026-10-27.
• Ransomware.live, "Victim: Machelen (Belgium) – rhysida", https://www.ransomware.live/id/TWFjaGVsZW4gKEJlbGdpdW0pQHJoeXNpZGE=, accessed 2026-10-28.

Both sources are the same leak-site index entry. No independent reporting, vendor analysis or official statement is available in this item.

8. Adverse Trace position

Adverse Trace assesses this as a data-exposure event at a Belgian public-sector body, not a compromise of client infrastructure. The severity of the underlying intrusion cannot be scored: no CVE, CVSS value, EPSS score or CISA KEV entry applies, and the attribution to Rhysida is unconfirmed because the group has no MITRE ATT&CK profile and the claim is single-sourced to the leak site. The client impact is indirect but concrete: identity documents, national register numbers and medical records of the kind banks hold on retail customers are now in criminal hands, which raises the value of those records for identity fraud and account takeover. We will monitor for corroborating reporting from Belgian authorities or the municipality, and we will update this advisory if the group publishes samples or if the victim confirms the scope. Clients that share data with Machelen or its OCMW should treat the P1 counterparty contact as the first action.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.