In late October and early November 2026, cyberattacks in and around Belgium made the news one after another: a federal public service, supermarket chains and a banking group. These are large organisations with their own IT departments. Yet they show exactly the weak spots we also find in smaller offices. In this article we set out the facts, each time with the question a notary can take away from it.
FPS Finance: the government could grant itself extra time
On 28 October 2026, the Federal Public Service Finance was hit by a cyberattack on its IT systems. MyMinfin, Biztax and other online applications were taken offline as a precaution. Tax returns temporarily could not be viewed or filed, and the FPS extended several filing deadlines to 16 November 2026. On 28 October, the FPS reported that there were no indications of a data breach at that time.
What does this mean for your office? The government could move its own deadlines. A notary office cannot: a deed signing or a statutory deadline cannot simply be postponed. So the question is not only whether you are protected, but also how quickly you are working again if something does go wrong. How many hours can your office function without its systems?
Supermarkets: suppliers' remote access
In October 2026, Ahold Delhaize took systems offline as a precaution after a cyberattack in the Netherlands: online ordering at Albert Heijn, the website and the app were unavailable. On 2 November 2026, refrigeration and freezer systems in Belgian stores of Delhaize, Carrefour and Spar, among others, were disrupted, leaving shelves empty. Stores in Luxembourg and Sweden were also affected. One Proxy Delhaize in Limburg reported a loss of at least 60,000 euros, and the federal prosecutor opened a criminal investigation.
Experts point to the remote access suppliers have to manage refrigeration systems: anyone with the password of such a management account can change settings. The cause has not been officially confirmed.
What does this mean for your office? Your office also has suppliers with remote access: telephony, printers, door intercom, software, maintenance. Do you know who can get in today, with which password, and whether that access is closed again when it is not needed?
Banks: the parent company of Keytrade Bank
On 4 November 2026 it emerged that the French banking group Crédit Mutuel Arkéa, the parent company of the Belgian online bank Keytrade Bank, lost more than 100 million euros in a cyberattack. According to the group, the attackers used the group's own account to send transactions to other banks and converted the money into cryptocurrency. The group says customers suffer no financial consequences.
What does this mean for your office? Attackers target money in transit. In a notary office, that is the client account: deed funds, advances, balances. Who in your office can prepare payments or change account numbers, and how is a changed account number checked before any money leaves?
The figures: more incidents, more phishing
The big names are not alone. Between 1 January and 28 September 2026, the Centre for Cybersecurity Belgium (CCB) received 588 reports of cyber incidents, more than in all of 2025 (556). System compromise is the most frequently reported type.
Phishing is rising too. In March 2026, the CCB received more than 42,000 reports per day, compared with an average of 27,000 per day in 2025. In the first quarter of 2026, that added up to more than 3.6 million.
What does this mean for your office? Smaller offices rarely make the news, but they are in these figures. A notary office receives emails from banks, clients and fellow notaries every day, and responding quickly is part of the job. That is exactly what phishing targets.
And the notary sector itself
Since early September 2026, fake emails have been circulating that pose as the Federation of Notaries. Notaris.be explicitly warns clients about account number fraud.
In the Netherlands, the KNB, the professional body of notaries, described in May 2026 how a notary's mailbox was hijacked. The hacker gained access to 360 emails with draft deeds, personal data and passport copies. Handling the incident took about two weeks, and the lost working hours were not covered by insurance.
What does this mean for your office? One hijacked mailbox is enough. Multi-factor authentication (MFA) on every account, a fixed agreement on how you confirm account numbers, and a plan for the first hour after an incident make the difference between a bad day and two weeks of recovery.
Five questions to ask today
- Which suppliers have remote access to our systems, and with which accounts?
- Is multi-factor authentication enabled on every mailbox and every admin account?
- How do we check a changed account number, and who may release a payment?
- How long until we are working again if the systems go down, and has that recovery been tested?
- Who does what in the first hour after an incident?
If you have a clear answer to these five questions, you are in a strong position. If you hesitate, you know where to start. With the Secure Notariaat audit we review your office across ten domains and you get the priorities in order.
Sources
- FPS Finance: VRT NWS, 28/10/2026, Baker Tilly
- Supermarkets: VRT NWS, 02/11/2026, NOS
- Banks: VRT NWS, 04/11/2026, ITdaily
- CCB figures: ITdaily, 16/10/2026, VRT NWS, 07/04/2026
- Notary sector: notaris.be/cybersecurity, KNB Notariaat Magazine, May 2026
Do you know where your office stands?
With the Secure Notariaat audit we review your office across ten domains, from network and backup to payment fraud, remote work and your suppliers' access. You get a score per domain and the ten priorities in order. Prefer to check where you stand first? Take the free maturity scan (3 questions).
Schedule your Secure Notariaat audit