Breaches and incidents
Vanden Broele / eSignFlow (Belgium): e-signature platform used by 100+ local authorities breached via exposed admin environment
Vanden Broele’s FAQ says an external attacker accessed eSignFlow data from 22 Oct 03:48 to 23 Oct 11:17, affecting “a large part of the organisations that...
- Disclosed
- Verification
- Checked against a primary source
What happened
- Vanden Broele’s FAQ says an external attacker accessed eSignFlow data from 22 Oct 03:48 to 23 Oct 11:17, affecting “a large part of the organisations that use eSignFlow”; exposed data includes signers’ names and national register numbers, names, emails, document titles and access codes, and for a small number of organisations full document content. Belgie Vandaag (citing VRT) reports more than 120 authorities use the service.
- Root cause: per the FAQ, “the attacker entered through a management environment that was reachable from outside”.
- No attacker named.
- eSignFlow was taken offline on 23 Oct and back online 24 Oct around 20:00; all keys were replaced, the CCB was notified on 23 Oct and the GBA (data protection authority) on 25 Oct, and a police report was filed.