Hundreds of organisations across Belgium have been affected by a large-scale cyber attack that compromised network security systems, according to cybersecurity experts.

Belgian cybersecurity firm Secutec reported that around 270 organisations—including law firms, local authorities, and educational institutions—were impacted after attackers breached firewall systems in February. More than 100 of those organisations remain vulnerable and can still be accessed online through stolen administrator credentials, the company said.

Investigators have linked the attack to a Russian hacking group. The operation targeted systems connected to US-based cybersecurity provider Fortinet and has been described by Secutec as one of the most significant security incidents ever involving a cybersecurity vendor.

The breach forms part of a wider global campaign that has affected more than 75,000 firewalls worldwide. Cybercriminals are believed to have stolen over 110 million login credentials since the campaign began earlier this year, with attacks continuing to unfold.

According to Secutec, hackers gained entry through Fortinet’s partner portal, a platform used by IT service providers to manage customer networks. By exploiting this central access point, attackers were able to infiltrate multiple organisations simultaneously.

The company also highlighted widespread security shortcomings among affected organisations. None of the compromised firewalls were protected by multi-factor authentication, many IT providers reused passwords across systems, and approximately 85% of the affected devices were running outdated software.

Despite efforts to address the breach, at least 150 compromised firewalls in Belgium remain directly exposed to the internet. A further 110 systems can still be accessed using administrator accounts obtained during the attack.

Secutec said it has notified Belgium’s Cybersecurity Centre and continues to monitor the situation as organisations work to secure their networks.

The CEDS website was also subjected to a DDoS attack that lasted nearly two days and was carried out from a Russian IP address.

The Russian authorities have long been targeting our Center's website. As part of a disinformation campaign, they even created a center in Latvia with a similar name. Acting through this organization, Russian intelligence services have been attempting to discredit our Center by inserting false information into Grokipedia and other reference materials. Photo by B_A, Wikimedia commons.