A notary, someone responsible for organising a training course or an administrative officer may be affected without being a lawyer. The cyberattack targeting AVOCATS.BE goes beyond the profession’s directory: around 27,500 other contacts are among those whose contact details were exposed, according to the statement published on 6 November by the Ordre des barreaux francophones et germanophone.
This figure is in addition to the lawyers affected. It therefore represents neither the total number of people affected nor a number of judicial case files stolen. The organisation reports unauthorised access to contact and identification data in its software for managing the bar associations, the LGO. It says that, based on its analysis to date, no banking data or sensitive data as defined in its statement was involved.
A professional tool that brought together far more than lawyers
The LGO is used for the activities of the orders and bar associations. The contact details recorded in it include those of professionals linked to the justice system, notably notaries and judicial staff, as well as bar association employees and training course organisers. Contacts from government departments, universities and police services are also included in the stated scope.
This diversity explains why someone outside the profession may receive an alert or need to remain vigilant. The criterion is whether their contact details were in the application because of their professional relationships with these institutions.
AVOCATS.BE represents the French-speaking and German-speaking bar associations of Belgium. The statement thus describes an incident involving an identified organisation and its management tool: it does not allow us to conclude that all Belgian judicial systems were attacked.
What is known about the data exposed
The information involved may include a person’s name, email address, telephone number and, in some cases, postal address. Its content depends on what had been entered in the application. The fields recorded were therefore not necessarily the same for everyone affected.
The organisation specifies that the figures and categories presented in its statement reflect the state of knowledge as at 3 November and may still change. Its update of 6 November should be read with this limitation in mind: the analysis is ongoing, even though the vulnerability has been secured.
The stated exclusion of banking data and sensitive data is attributed to AVOCATS.BE. This does not mean that professional contact details are without value. Conversely, the information published does not allow us to claim that court documents, confidential communications between lawyers and clients or defence case files were stolen. Making this distinction avoids adding a scope that has not been confirmed to a confirmed data breach.
An attack reported on 29 October
AVOCATS.BE says it was informed of the attack on 29 October. According to the organisation, the incident was identified and neutralised that same day, within hours of it being reported. The data that had been accessed unlawfully was then offered for sale on the dark web by people who had not been identified at the time of the statement.
Securing the software and eliminating copies are two different questions. Closing the access used by the intruders prevents it from being left open; it does not prove that data already taken has been erased.
The Ordre says it has preserved evidence, commissioned an analysis with a specialist provider, reset access, changed passwords and strengthened authentication. It has notified the incident to the Autorité de protection des données and the Centre pour la Cybersécurité Belgique, and says it will file a complaint. Monitoring the online circulation of the data is also among the measures cited.
Why publicly available contact details can still be used for fraud
AVOCATS.BE notes that a large proportion of these contact details were already available in directories. This limits how new some of the information is, but not all possible malicious uses. The organisation itself mentions the risk of cross-referencing with other sources, abusive marketing, phishing and identity theft.
A message that knows a person’s name, job title or connection with a bar association may seem more credible than an impersonal email. For example, it could invoke a training course or an administrative check to ask for a payment or login details. This is a risk scenario, not a campaign known to have taken place in this incident.
The right thing to check is therefore the request and the channel used, not just whether the information is accurate. In its advice on phishing, Safeonweb points out that an apparently legitimate sender address does not, by itself, guarantee that a message is authentic.
Practical steps for people affected
If you receive an unusual or urgent request, it is better to contact the organisation using its usual contact details or those on its official website. Avoid using the number or link provided in the suspicious message to verify it. Do not provide any login details, password or banking information under pressure from such a request.
Suspicious messages can be forwarded to suspect@safeonweb.be. If you have actually entered a password on a fake website, Safeonweb recommends changing it immediately, as well as on any services where it has been reused. This step addresses an actual compromise of login details; it does not mean that the passwords of all contacts were included in the reported data breach.
For questions about their own data, the contact point given by AVOCATS.BE is its data protection officer, at dpo@obfg.be. The organisation says it is unable to contact each person affected individually and is using this public communication to inform them. People can also lodge a complaint with the Autorité de protection des données.
Archive photograph: the Brussels Palace of Justice illustrates the Belgian judicial context; it does not indicate where the intrusion took place. Credit: Romainberth, Wikimedia Commons, CC BY-SA 3.0.
