According to a report by the Flemish Supervisory Commission, the city of Antwerp was not prepared for cyber threats. “This is even more painful when it comes to such large organizations.”
In December 2022, the city of Antwerp fell victim to a large-scale cyberattack. It now appears that the city was not prepared for such attacks, says a report by the Flemish Supervisory Commission (VTC) for Personal Data. According to the report, they had no recovery plan and important updates were not implemented. The icing on the cake was the lack of two-step verification, a secure and easy way to log in remotely. The report is very harsh on Digipolis, which is responsible for the city of Antwerp’s IT and municipal services.
Holes in the system
The city of Antwerp was harassed for months by a major cyberattack in 2022. Many services failed, files were delayed and personal data was lost. The cybersecurity of the city of Antwerp before this major cyberattack in 2022 was therefore lacking and the VTC makes this very clear in a new report. It states that important updates were not implemented, network segmentation was missing and even two-step verification was barely implemented.
A lot of personal data was lost in this cyberattack, including sensitive information from nursing homes or the population service, for example. In addition, it was not clear at the time exactly what data was involved, which made it difficult for them to estimate the extent of the attack and to foresee it.
Inadequately prepared
While the report stresses that measures were taken to strengthen the city’s cybersecurity in the months before the attack, these were far from sufficient to be prepared for a cyberattack. It concludes that “the measures were not implemented rigorously and adequately.”
“This is all the more painful when it is a very large organisation that is expected to have sufficient resources to prevent incidents where possible or at least to manage them effectively,” the report says. The VTC is currently awaiting a new report with insights into the steps that have since been taken.