Edpnet

Summary

A Belgian telecom operator experienced a cyber attack compromising its administrative systems, with no confirmed data theft or impact on internet services. Customers encountered login issues due to technical disruptions, while the company isolated affected systems and initiated an investigation with cybersecurity experts. The incident marked the third major attack on Belgian entities within a week, following breaches at a brewery and a coffee roaster.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On March 9, 2024, Belgian telecommunications provider Edpnet experienced a cyber attack targeting its administrative systems. The company detected technical anomalies beginning Saturday morning but did not formally notify customers until Monday evening, indicating a multi-day delay in public communication. Attackers successfully penetrated Edpnet’s administrative infrastructure, though the organization stated no evidence confirmed data theft or subsequent misuse of information. Immediate operational impacts manifested through customer login failures for account management portals, though core internet and mobile services remained fully operational throughout the incident. Edpnet, operating as an independent subsidiary of telecom firm Citymesh since November 2023, serves approximately 46,000 fixed internet subscribers and 13,500 mobile customers according to Proximus data from early 2023.

Edpnet initiated containment measures by isolating compromised systems, asserting this action limited the attack’s scope to administrative functions. The company engaged cybersecurity specialists to investigate the breach and implement enhanced protective measures for its infrastructure. Internal assessments characterized the organizational response as “quick and appropriate,” though the timeline suggests at least 48 hours elapsed between initial system disruptions and customer notifications. No ransomware involvement was confirmed, distinguishing the incident from contemporaneous attacks on Belgian entities Duvel Moortgat breweries and Koffie Beyers coffee roaster earlier that week. Customer-facing disruptions remained confined to account access interfaces, with restoration timelines undisclosed as of the last reported update. The investigation remained ongoing with no additional technical specifics regarding attack vectors or threat actors disclosed.

Sources

Sources available to members: 1 source.