Belgian Hospitals and Organizations Hit by Supply Chain Data Breaches Security firm Secutec uncovered a series of data breaches affecting at least five Belgian hospitals and additional commercial and government entities, exposing over 72,000 personal and login credentials on the darknet. The incidents stemmed from cyberattacks on third-party suppliers, including a patient registration software provider used by the hospitals and a separate IT supplier linked to other organizations. The investigation began after the AZ Monica hospital in Antwerp fell victim to a cyberattack, leading Secutec’s security team to identify four more healthcare institutions using the same compromised software. A second breach at an IT supplier exposed an additional 1,000 login details from non-healthcare organizations. Secutec CEO Geert Baudewijns highlighted that while Belgian hospitals maintain robust cybersecurity measures, vulnerabilities often originate from external suppliers. The European NIS2 directive, effective in Belgium since October 2024, now mandates third-party security audits to address these risks. Baudewijns noted that password-stealing malware often installed unintentionally by IT personnel with admin privileges poses an equal threat to unpatched vulnerabilities. Following the discovery, Secutec alerted the Cybersecurity Center Belgium and the affected hospitals, recommending password resets, backup system testing, and network scans to detect further intrusions. The incidents underscore the growing risk of supply chain attacks and the need for stricter oversight of third-party vendors.