Update 2 October 2026 - 11:00
What happened?
On 24 September 2026, Belnet identified a security and privacy incident within its IT infrastructure. The incident was caused by the exploitation of a zero-day vulnerability affecting technology provided by our external supplier Fortinet.
Fortinet has published further technical information about the vulnerability, including the corresponding CVE. More information is available in Fortinet’s security advisory FG-IR-26-175.
Upon detecting the incident, Belnet immediately took measures to stop the incident, address the vulnerability and contain the data breach. The vulnerability was remediated on Friday, 25 September at 08:10.
Belnet has engaged the Centre for Cybersecurity Belgium (CCB) for additional expertise in incident response and forensic investigation. The competent authorities have also been informed in accordance with our regulatory obligations. Belnet has immediately implemented additional security measures to improve the security of the service and continues to monitor the situation closely. We are conducting a thorough investigation to determine the precise nature and scope of the incident and to identify any other parties that may have been affected.
What data was affected?
Based on our investigation to date, we have established that the incident affected emails processed through the impacted infrastructure between 22 July 2026 and the morning of Friday, 25 September 2026.
This includes:
- All incoming emails sent to domains owned by Belnet email addresses (guestroam, BNIX …), including the sender details, content of those emails and any attachments.
- All download links generated and sent directly by our FileSender and FedSender services during this period (see below). As a result, it is possible that the attackers could have used them to access and download the associated transferred files.
- Important: FileSender and FedSender transfers that were protected with a password and/or required user authentication cannot be read, provided the password was not added in a comment during upload, as per acceptable use instructions.
- Guestroam accounts generated via the Belnet guestroam service
During the affected period, emails were copied by the attackers and transferred to external infrastructure. Belnet has directly informed its customers about the incident and the measures they should take.
Our investigation is ongoing and is intended to provide further clarity on the precise scope of the incident and identify any other potentially affected parties.
FileSender and FedSender: information for users who created transfers
The incident also has implications for transfers made using Belnet's FileSender and FedSender services between 22 July 2026 and the morning of Friday, 25 September 2026.
As a result, it is possible that these links could have been used to access the associated files.
Transfers protected by a password and/or requiring user authentication are not considered affected in this way, provided the password was not added in a comment during upload, as per acceptable use instructions.
As a precautionary security measure, on 29 September Belnet removed download links that were still active and disabled transfers created during the affected period. These actions automatically generated notifications to senders and recipients stating that their transfer had been disabled or was no longer available.
- If you created a transfer that has been disabled and the files still need to be shared, please create and send a new transfer.
- If you were the recipient of such a transfer and still require access to the files, please contact the original sender and ask them to create a new transfer. Belnet cannot recreate or resend transfers on behalf of FileSender / FedSender users.
We understand that the possibility that files shared through FileSender or FedSender may have been accessed by unauthorised parties can be concerning, particularly where these files may contain personal, sensitive or confidential information.
We sincerely regret this incident may cause and are continuing our investigation to establish the full impact.
Ongoing investigation
Belnet continues to monitor the situation closely and is pursuing its investigation. We will continue to provide relevant updates as our investigation progresses.
At this stage, no further information is available regarding the identity or affiliation of the threat actor responsible for the incident.
Contact
- Registered Belnet customers can contact our Belnet Support. There is a FAQ available as well on the Belnet Portal.
- FileSender/FedSender users can contact our Data Protection Officer at dpo@belnet.be with questions regarding their personal data. As we are currently handling a significant number of enquiries, it may take longer than usual to respond. We thank you for your patience and understanding.
- Private individuals who are not Belnet customers and who have sent emails to Belnet between 22 July 2026 and the morning of 25 September 2026 can contact our Data Protection Officer at dpo@belnet.be with questions regarding their personal data. We are prioritising support for our customers and end users. We therefore kindly ask for your patience and understanding if our response takes longer than usual.