Cyber Incident Victim: Service public de Wallonie
Date:
Apr 2025
Location:
Belgium
Summary
The Service public deWallonie experienced a cyberattack that prompted its strategic committee, with government approval and in coordination with the Belgian Cybersecurity Centre, to temporarily sever all internet connections to assess the extent of compromise and initiate security measures. While no confidential data breach has been confirmed, the organization anticipates major consequences as all digital applications, including the Wallonie.be portal and Mon Espace service, remain offline, affecting public missions. Special precautions have been taken to keep critical infrastructure such as roads, locks and airports operational and secure, with ongoing monitoring and crisis‑cell coordination, and updates are being shared via the Wallonie.be Facebook page.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 0 motives | 3 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On April 17 2025 the Radio Télévision Belge Francophone reported that the Service public de Wallonie (SPW) had been targeted by a cyberattack. Following the detection of an intrusion into its information system, the SPW’s strategic committee, with the approval of the Walloon government and in consultation with the Belgian Cybersecurity Centre (CCB), decided to cut all internet connections temporarily. The stated purpose of this measure was to limit the potential impact, assess the level of compromise across the IT infrastructure, and initiate appropriate security actions. The committee emphasized that, at that stage, there were no indications that confidential data had been exfiltrated, but they could not provide a timeline for the resumption of normal operations.
The disconnection resulted in the immediate cessation of all digital services offered by the SPW, including the public websites Wallonie.be and Mon Espace, which handle administrative procedures for citizens. Officials warned that the interruption would have major consequences for the organization’s missions and would significantly disrupt services in the coming days. To mitigate risks to essential functions, a crisis cell was established to identify and prioritize urgent needs, and special safeguards were applied to the applications that interact with critical infrastructure such as road networks, locks, and airports, allowing those systems to continue operating safely. Continuous monitoring of the effects of the internet cutoff on these tools was put in place to ensure ongoing operational integrity.
In parallel, the SPW committed to keeping the public informed about the evolution of the incident through transparent updates posted on the Wallonie.be Facebook page. The organization acknowledged that while the disconnection was a drastic step, it was considered the only viable option to prevent a more severe compromise of its networks. No further details about the attackers, their motives, or specific technical indicators were disclosed in the reported statements.