Rhysida Ransomware Claim Hits Belgian Town of Machelen, With Welfare and Medical Files Listed

Rhysida Ransomware Claim Targets Machelen Municipality

A ransomware group calling itself Rhysida claimed on October 27 that it had hit Machelen, a municipality in Belgium, and listed municipal and social welfare file servers among its haul. The claim, reported on October 28, describes about 1.3 million files totalling around 2.9 terabytes, including a working copy and a backup copy of file servers. The claim is unverified by the municipality in the reporting so far, and that distinction matters: a ransomware claim is not the same as a confirmed breach, but the type of data listed is exactly why municipal attacks worry security researchers.

According to the claim summary, the listed material includes social welfare and migration service client files, passports, ID cards, residence permits and sick notes. It also lists nursing home medical files, staff HR dossiers, workplace accident records, civil status records such as births and marriages with national register numbers, payslips and financial data, and a large volume of correspondence and employee home folders. A full social welfare database backup from September 2026 and thousands of database files were also listed. Researchers verifying the claim reportedly found personal data in a sample of files, including a valid Belgian ID card and passports.

Why Municipal Data Is Especially Sensitive

Municipalities hold data people cannot simply change. You can replace a bank card. You cannot replace a birth record, a national register number, or a medical file from a nursing home stay. Welfare and migration files are more sensitive still, because they document vulnerability: who needed help, why, and what support they received. When that kind of data is listed for sale or publication, the harm is not just financial fraud. It is exposure of private life details to anyone who downloads the leak.

That is also why municipal attacks are so disruptive in practice. A town hall cannot just close for a week while systems are rebuilt. Residents still need certificates, benefits payments still need processing, and care services still need staff records. Ransomware groups know this, which is why local government has become a regular target. The payoff is pressure: pay, or watch residents' data appear online.

What the Claim Does and Does Not Prove

It is important to separate three things: the claim, the sample verification, and official confirmation. The claim comes from the group itself, which has an interest in exaggerating. The sample verification, where researchers check a subset of listed files, can show that at least some real personal data is in the group's hands, but it does not prove the full 2.9 terabyte figure or that every system named was breached. Official confirmation from Machelen would clarify scope, timeline and which services are affected, and residents should wait for that before assuming the worst about any specific record.

That caution does not mean doing nothing. People in Machelen who have used municipal welfare, migration or civil status services should watch for official guidance, be wary of phishing messages that quote personal details, and avoid clicking links in unexpected messages claiming to be from the municipality. Attackers often follow a leak claim with targeted phishing, using real details to make fake messages convincing. The WhiteArmor LoveSac breach claim showed a similar pattern recently, where a claim listed a large volume of order records and readers had to separate claim from confirmation.

The Bigger Pattern: Small Targets, Big Data

Machelen is not a large city, and that is the point. Attackers do not need a capital city to find sensitive data. A single municipality can hold welfare files, medical records, HR dossiers and civil registers for thousands of residents, often on systems maintained by small IT teams with limited budgets. The Teams vishing attacks linked to Chaos ransomware showed another route into organizations through fake IT support calls, a reminder that the weakest link is often a person being tricked, not a firewall failing.

For other municipalities, the lesson is unglamorous but clear: separate backups that ransomware cannot reach, limit who can access welfare and medical files, patch exposed systems promptly, and rehearse what to tell residents when a claim appears. A fast, honest public statement does more to protect residents than silence, because silence leaves room for the attackers' version to spread.

What to Watch Next

Watch for an official statement from Machelen confirming or denying the breach, describing affected services, and telling residents what to do. Watch also for whether the group publishes a deadline or a sample, which is the usual pressure tactic after a claim. Until then, treat the Rhysida claim as a serious, partially sampled allegation, not a confirmed fact, and treat any message that uses personal details from municipal files with extra suspicion. The data types listed are the reason this claim deserves attention, even before confirmation arrives.