The Rhysida ransomware group has put the Belgian municipality of Machelen on its leak site. It claims to have published about 2.9 TB of data, roughly 1.3 million files, taken from the file servers of the local government and its social welfare service (OCMW/CPAS). Machelen confirmed on 22 September 2026 that personal data had been stolen in a cyberattack it detected on 11 September. That confirmation came days after the mayor publicly said there was no sign of a data leak. The municipality has not said which data was taken or how many people are affected, and it has not publicly named Rhysida as the attacker. The detailed inventory of stolen files comes from the group's own leak-site post, as reproduced by threat monitoring services.
What Happened
Machelen's local government says it detected a cyber incident on Friday 11 September 2026 that affected "various digital systems and services." According to Mayor Jean-Pierre De Groef, speaking to HLN, it started when an employee clicked on a phishing email that appeared to come from the fire service. As a precaution, all municipal IT systems were shut down.
From 15 September the municipality restored its systems one service at a time. The social service, civil affairs (Burgerzaken) and finance came back first, with email and phone lines following the next day. De Groef told HLN that systems were being rebuilt with new security certificates and passwords, and that every employee account was being reset.
In the same interview, the mayor said the IT department had found "no indication" that files had been downloaded from municipal servers. He said there had been two attempts to take data, but that neither appeared to have succeeded, and that the municipality expected to be certain by the end of that week.
That position did not last. In a statement on its website dated 22 September, the municipality said that "after further thorough analysis" it could confirm personal data had been stolen after all. It added that the investigation into the nature and scale of the leak was still under way. Tweakers, citing VRT NWS, reported that De Groef said it was "certainly not the case" that the data of every Machelen resident had been stolen. The municipality has filed a complaint with the police and with the Halle-Vilvoorde public prosecutor's office. Its services are now running again, though it warns some may be slower than usual.
Rhysida's leak-site listing was reported on 27 October by DeXpose and on 28 October by ThreatMon and QPulse, about six weeks after the intrusion. The municipality's public statements do not say whether systems were encrypted or whether a ransom was demanded. Publishing the full dataset is how Rhysida usually responds when a victim does not pay, but no source confirms that this happened here.
What Was Taken
Machelen has confirmed only that personal data was stolen. Everything below comes from Rhysida's own description of the dataset, which DeXpose quoted in full and QPulse repeated. The group's claims include:
- Volume: about 1.3 million files totalling roughly 2.9 TB, mostly in Dutch and partly in French. The group says this includes both the working copy and a backup copy of the OCMW file servers.
- Social welfare and migration case files: passports, ID cards, residence permits and sick notes.
- The municipal nursing home (WZC): residents' medical files, staff HR files and workplace accident records.
- Civil status records: birth and marriage records containing Belgian national register numbers (NISS/RRN).
- Staff and finance: payslips, financial data, around 23,000 pieces of correspondence and employee home folders.
- Databases and backups: a full 6 GB OCMW database backup dated September 2026, 645 .mdb databases, 12,873 .dbf files and 110 .bak files totalling 17 GB.
The group also says it "verified" 13,319 files containing personal data. Among them, it says, are a valid Belgian ID card expiring in February 2029, Belgian and Moroccan passports, national register numbers, sick notes with patient addresses, and medical documents that fall under GDPR Article 9 special categories. QPulse presents these figures as technical analysis of the leak. DeXpose shows them as part of the threat actor's statement. Machelen has not independently confirmed any of these numbers.
UNDERCODE NEWS points out that a leak-site listing on its own does not prove what was taken. In this case, though, the municipality's confirmation that personal data was stolen gives the claim real weight. What is still unverified is the scale and exact contents.
Why It Matters
This is the data of the most vulnerable residents. Social welfare and migration case files, nursing home medical records and identity documents belong to people who often have little ability to protect themselves from fraud or exploitation. Passport and residence permit scans combined with national register numbers are ideal material for identity fraud and for convincing, targeted phishing.
The backups were taken too. If Rhysida's claim about working and backup copies is accurate, the attackers were able to read the backup storage. Backups that the main network can reach cannot be counted on to limit the damage.
The early message was wrong. Telling residents on 15 September that there was no indication of a data leak, then reversing that a week later, is a pattern seen in many public-sector incidents. Commenters on Tweakers criticised the municipality for stating confidently that nothing was lost instead of admitting it did not yet know. Organisations should assume data has been taken until forensic work proves otherwise, and should communicate on that basis.
Small local governments are attractive targets. Belgian municipalities and OCMWs hold large amounts of sensitive data, often with small IT teams. Ransomware groups pick targets where the pressure to pay is highest, and leaked welfare and medical data puts a great deal of pressure on a local authority.
The Attack Technique
The only account of how the attackers got in is the mayor's statement to HLN: an employee clicked a phishing email that appeared to come from the local fire service. Using a trusted local partner's name like this is a common way to get past staff suspicion.
Nobody has published technical details of what happened next, such as how the attackers moved through the network, which accounts they used, or how they took out 2.9 TB. The municipality said it detected two attempts to take data, but later confirmed that data had in fact been stolen. That suggests the copying either went undetected at first, or happened over a route the first analysis missed. The claim that backup copies were taken points to broad access across the network. Whether files were encrypted has not been publicly confirmed.
What Organizations Should Do
- Harden email against impersonation of local partners. Flag external mail that uses the names of emergency services, neighbouring councils or suppliers. Enforce DMARC, and train staff with phishing simulations that copy these local lures.
- Separate and lock down backups. Keep at least one backup copy offline or immutable, on credentials the main domain cannot reach. Regularly test whether an ordinary domain admin account can read or delete backups. If it can, an attacker can too.
- Watch for large outbound transfers. Alert on unusual volumes leaving file servers and on bulk archiving or staging of data. Taking 2.9 TB leaves traces that properly tuned network monitoring should catch.
- Restrict who can open sensitive case files. Limit access to welfare, migration and medical shares to the staff who need it. Shut down old .mdb/.dbf databases and scattered .bak files, which tend to build up unmanaged on file servers.
- Assume data was taken until shown otherwise. Bring in outside forensic investigators early. Notify the Belgian Data Protection Authority within GDPR deadlines, and avoid public statements that rule out a leak before the investigation is finished.
- Prepare the people who are affected. Once the leak is public, warn residents about phishing that uses their stolen details. Help them replace compromised identity documents and watch for fraud involving national register numbers.
Sources: Rhysida Ransomware Group Exposes 2.9 TB of Data from Machelen Munic... | Cyberincident Machelen - Gemeente Machelen-Diegem | Rhysida Targets Belgian Municipality Machelen - DeXpose | Trinetra Threat Intelligence Live global ransomware map | Rhysida Claims Cyberattack Against Machelen, Belgium, Raising Quest... | Machelen herstart gemeentelijke diensten na cyberaanval: “Nog steed... | Machelen meldde geen aanwijzingen voor datalek, maar hackers stalen... | CenterPoint Energy confirms customer data stolen in cyberattack – D...