Belgian municipalities are warning residents to watch for phishing after criminals broke into eSignFlow, a digital document-signing tool from the software supplier Vanden Broele. The company says the attackers mainly obtained metadata, such as the names of people who signed documents and the titles of those documents, and that the system is back online after the weak point was closed.
What happened
Tweakers reports that the attackers got into eSignFlow, a platform Belgian municipalities use to sign documents digitally. Vanden Broele, the Belgian company that supplies it, noticed suspicious activity on its servers and took them offline on Friday afternoon. According to the company, the tool came back online on Saturday evening after it had closed the vulnerability the attackers used and blocked the IP addresses involved.
How much data was exposed depends on the municipality. Tweakers writes that many municipalities appear to have lost very little data, while for some the leak is larger. Vanden Broele told the Belgian press agency Belga, as reported by HLN, that the criminals mostly took metadata. In practice that means the names of signers and the names of documents, rather than the documents themselves.
The company also made a firm claim about the signatures. Director Bram van Impre said Vanden Broele is completely certain that no one signed anything in someone else’s name. That matters because a signing platform is only useful if people can trust that a signature belongs to the person whose name is on it.
Even so, municipalities chose to warn the public. Tweakers reports that many of them are asking residents to be careful with unexpected emails, phone calls or other messages that ask for personal details, payment information, passwords or codes.
Why it matters for internationals in the Netherlands
This incident happened in Belgium, and the Tweakers report does not mention any Dutch municipalities or Dutch users of eSignFlow. It still has direct lessons for anyone who has recently moved to the Netherlands, and especially for people with ties across the border. If you lived in Belgium before, still own property there, or have dealt with a Belgian town hall for permits, registrations or contracts, your name could be among the signer records. A phishing message that uses your real name and refers to a real document is far more convincing than the generic scams most people have learned to ignore.
That is why “only metadata” should not be read as “nothing to worry about”. A list of names linked to municipal documents gives scammers what they need to build a believable story. Picture an email that names a document you really did sign, says the municipality needs to confirm your payment details, and links to a page that looks official. The municipalities’ advice targets exactly this pattern: be suspicious of any unexpected message asking for private data, bank details, passwords or verification codes.
The same habits protect you in the Netherlands. Internationals here quickly build up accounts with the gemeente, the Belastingdienst, health insurers, banks and housing platforms, many of them reached through DigiD. Each of these is a familiar name a scammer can borrow. When a message pushes you to act fast, do not use the link or phone number in it. Go to the organisation’s official website or app yourself, or call a number you have looked up independently. Public bodies and banks have no reason to ask you for a password or a one-time code by email or phone.
The story also shows how much everyday government business now depends on outside software suppliers. Most residents have never heard of Vanden Broele, yet its tool sat in the middle of official paperwork for many Belgian municipalities. When one supplier is breached, the effects reach every organisation that uses it at once. Dutch municipalities also lean on external platforms for digital services, so the question of how well suppliers protect their servers applies on both sides of the border.
On privacy, Belgium and the Netherlands both fall under the EU’s General Data Protection Regulation, which gives individuals rights over their personal data, including the right to ask an organisation what it holds about them. If you think your details may have been involved, the organisation you dealt with, here a municipality, is the right place to ask. The source does not say whether individual residents are being notified one by one or what regulators are doing, so it is too early to say what formal follow-up there will be.
For people working in the Dutch tech and startup sector, the report is a useful reminder of what customers expect when something goes wrong. Vanden Broele took its servers offline the moment it saw suspicious activity, closed the vulnerability, blocked the attackers’ addresses and had the service running again the next evening. Whether that response turns out to be enough will depend on what the full investigation finds. Anyone building software for governments or other trust-dependent services will recognise the pressure to move fast while still telling users clearly what was taken.
What to watch next
The first thing to watch is whether the municipalities that lost more data explain exactly what was exposed and who is affected. Tweakers reports that the impact differs between municipalities, but the source does not list them or say how many residents are involved. More detail would help people judge their own risk.
The second is whether the phishing the municipalities expect actually starts to appear. Scam campaigns built on leaked data often arrive weeks after the breach, when people have forgotten the news. If you have Belgian connections, stay alert well beyond the next few days, and treat any message that mentions a signed municipal document with extra care.
The third is how Vanden Broele’s account holds up. The company is confident that only metadata was taken and that no signatures were forged. Independent findings, if they are published, will show whether that confidence is justified. Until then, the practical advice is the same as the municipalities’: never share codes, passwords or payment details in response to a message you did not expect, and always verify through a channel you found yourself.
Source: Tweakers
Sources
- Tweakers: Belgische gemeenten waarschuwen voor phishing na hack ondertekensoftware, accessed 27 October 2026
The Netherlands, for internationals
One email a week: the week's news for internationals in the Netherlands, new practical guides and what changed in the cities. No spam, unsubscribe any time.
