Skip to content
Cyber Threat
CTI Academy Sponsor CTI Academy
BE

Ransomware attacks in Belgium

142 organisations in Belgium have been listed on ransomware leak sites, ranking #26 worldwide. Updated .

Victims
142
0.6% of global total
Global rank
#26
of 180 countries
Active groups
47
Most: Qilin
Sectors
17
Most: Business Services

ThreatAI analysis

Compiled from this database and the ransomware.live profiles of the groups active in Belgium. Figures are computed from the tracked records, not inferred.

Ransomware activity targeting Belgium reaches 142 recorded victims placing it at 25 globally where malicious groups Qilin and Akira show most activity in sectors like Business Services and Technology, Manufacturing that suffer the brunt.

Belgium in the global picture

Belgium accounts for 142 of the ransomware disclosures tracked here, ranking #26 worldwide and making up 0.6% of the global total. The sectors listed most often are Business Services, Technology, Manufacturing.

Who is most active in Belgium

Qilin — 18 victims in Belgium. Qilin ransomware was first observed in July of 2022. Akira — 8 victims in Belgium. The Akira ransomware group is said to have emerged in March 2023, and there's much speculation about its ties to the former CONTI ransomware group. Killsec — 8 victims in Belgium.

Where to report an incident in Belgium

National computer emergency response teams for Belgium, as registered with ENISA and the teams themselves. Regional, sectoral and vendor response teams are excluded; verify current contact details before relying on them in an incident.

Ransomware threat profile: Belgium

Belgium ranks #26 worldwide for ransomware disclosures, with 142 victims in this database — 0.6% of the global total. The groups listing the most organisations here are Qilin, Akira and Killsec.

The most frequently listed industries in Belgium are Business Services, Technology, Manufacturing. Healthcare is especially exposed: an outage at a hospital or clinic can put patients at risk, which raises the pressure to pay quickly.

The volume reflects Belgium's integration into the global economy and the reach of ransomware operations that target organisations of every size. Organisations here should weigh the active groups documented on this page when prioritising detection rules and incident-response planning.

Victims in Belgium 142

Page 1 of 2
Organization Disclosed
WSBI-ESBG
Play
assist2enjoy.be
Safepay
assist2enjoy.be
Safepay
Corswarem Group
Thegentlemen
Corswarem Group
Thegentlemen
eagroep.com
Safepay
CENELEC
Everest
takt.be
Lockbit5
WEBA Meubelen
Qilin
Connections
Qilin
Université Libre de Bruxelles
Qilin
LensAss Architecten
Thegentlemen
Rodschinson Investment
Everest
CEN and Cenelec
Coinbasecartel
Adpo
Qilin
Orimar
Qilin
****.com
Section9
windiam.com
Braincipher
Sintax
Qilin
FTL-Fast Transit Line
Nova
Calipage Humblet
Thegentlemen
consultic.be
Threeam
C2O Architects
Thegentlemen
ettp.be
Safepay
Fabritius
Thegentlemen
isosl.be
Apt73
vanheyghenstaal.be
Apt73
Anderlues
Thegentlemen
Asaniverko
Spacebears
Fountain
Dragonforce
Efficy - 43gb leaked
Coinbasecartel
nandrin.be
Lockbit5
Fondation Boghossian
Qilin
Louise Medical Center
Qilin
Netwerk NV
Ailock
Abutriek
Qilin
Evolutive Systems
Qilin
Symeta
Coinbasecartel
Efficy
Coinbasecartel
Van Eycken
Akira
Soapeople
Payoutsking
jefar.be
Lockbit5
Victoria Benelux
Qilin
Rconcept
Nova
SCIPIONI
Morpheus
bpost
Tridentlocker
S****e
Payoutsking
AGFA
Everest
PCB Uitvaartzorg
Qilin
ANSELL.COM
Clop
VZW Avalon
Incransom
Cadorim
Killsec
Volumex Lease
Radar
Menten Truck Service N.V., Hoeselt, Belgium
Radar
identic.be
Qilin
seabridge.eu+efico.com
Qilin
Töller
Incransom
Primoris
Worldleaks
De Noordboom
Beast
Pilipili
Akira
Huize Sint-Augustinus_BE
Incransom
Agaris
Worldleaks
AP Lettering
Spacebears
Letry
Global
La Maison Liégeoise
Datacarry
Étude Bordet
Datacarry
Ghent Dredging
Akira
Horecamaterialen De Meester NV
Worldleaks
Commune de Jemeppe-sur-Sambre
Ransomhouse
Decoline
Sarcoma
C-Mec
Ransomhouse
Pharma Force
Hunters
On IT
Termite
The Komec
Qilin
CS Plastics
Akira
Euranova
Fog
Melexis
Fog
www.cda.be
Ransomhub
Cronos Europa
Akira
foyernotredamedepaix.be
Safepay
phidac.be
Funksec
HE2B
Fog
Héron
8base
brachot.com
Blackbasta
Omnitravel
8base
Saint-Bar (saintbar.be)
Fog
Vroninks Ricker Weyts & Sacre- Notaires (notassoc.be)
Fog
Chemitex SA Information
Play
Extra
Lynx
Kela Health
Medusa
BusinessTraining.be
Safepay
euromedix.com
Safepay
potteau.com
Ransomhub
potteau.be
Ransomhub
interlabel.be
Ransomhub
Groupseco.com
Ransomhub
lolaliza.com
Blacksuit
polypane.be
Ransomhub
Kerkstoel
8base
CobelPlast
Hunters
1–100 of 142

Frequently asked questions

How many ransomware attacks have occurred in Belgium?

Belgium has recorded 142 ransomware victim disclosures in this database, ranking #26 globally. This represents 0.6% of all tracked ransomware attacks worldwide.

Which ransomware groups target Belgium?

The ransomware groups most active in Belgium are Qilin, Akira, Killsec, Thegentlemen. These groups collectively account for the majority of victim disclosures attributed to Belgium.

Which industries are most targeted by ransomware in Belgium?

In Belgium, the most frequently targeted sectors are Business Services, Technology, Manufacturing. These industries hold valuable data and often have critical operational requirements that make them attractive ransomware targets.

How does Belgium rank globally for ransomware attacks?

Belgium ranks #26 globally for ransomware attacks with 142 victim disclosures, representing 0.6% of the worldwide total of 23,585 tracked victims.

How can organisations in Belgium protect against ransomware?

Organisations in Belgium should implement a layered security approach including regular offline backups, network segmentation, multi-factor authentication, endpoint detection and response (EDR) tools, and employee security awareness training. Monitoring threat intelligence feeds for active groups targeting Belgium is also recommended.