Brussels: Europe and the Arabs
The Federal Prosecutor's Office in Brussels confirmed that it is investigating a case related to the alleged espionage of a Belgian security agent. Politico reported that a man was arrested in Brussels on suspicion of espionage, and the Federal Prosecutor's Office confirmed the news. According to local media, including the Flemish-language Belgian newspaper Nieuwsblad, according to Politico, the suspect is a security agent who spied for China, but the Federal Prosecutor's Office cannot confirm this.
Yasmina Vanoverschelde of the Federal Prosecutor's Office stated: "It is true that a person working for a security agency has been arrested on suspicion of espionage. The investigating judge has charged him and released him under strict conditions." The specific security agency for which the man worked has not been disclosed. It's worth noting that last February, the Belgian spy agency was hacked. Wiz Caze reported that customers' personal data was compromised. Belgian authorities launched an investigation into a cyberattack that compromised the country's intelligence agency, the State Security Service (VSSE), as first reported by Le Soir.
The breach, described as the most severe in the agency's history, was part of a Chinese espionage operation that exploited vulnerabilities in the software of the American cybersecurity company Barracuda.
The Federal Prosecutor's Office confirmed at the time that it had received a formal complaint from VSSE about the cyberattack, which, according to Reuters, lasted from 2021 to 2023.
According to the Belgian newspaper Le Soir, the hackers gained access to the agency's external email server and intercepted approximately 10% of VSSE's incoming and outgoing emails.
The hackers are believed to have obtained correspondence with law enforcement agencies, government ministries, and other institutions. While classified data remained secure, personal information belonging to approximately half of VSSE's employees may have been compromised.
"We thought we'd bought a bulletproof vest, only to find a huge hole in it," an intelligence source told Le Soir.
The Brussels Times (BT) explains that the attack targeted a vulnerability in Barracuda's Email Security Gateway, a firewall designed to protect email communications.
Barracuda disclosed the vulnerability in 2023, warning that state-backed hacking groups had exploited it. The Belgian Secret Service and the Belgian Pipeline Organization, which oversees pipelines in the North Sea, were among the affected entities.
Politico reports that cybersecurity researchers from Google's Mandiant division have previously linked the attack to a Chinese cyber espionage group. The Chinese embassy in Belgium did not immediately respond to requests for comment.
The timing of the breach was particularly concerning, occurring during a recruitment drive to expand VSSE's workforce. Several new employees at the agency—some of whom are still undergoing security checks—may have had their personal data compromised, as reported by The Brussels Times BT.
Following an internal review, VSSE filed a formal complaint in November 2023. Since then, the Federal Prosecutor's Office has launched a judicial investigation but has not revealed any preliminary findings. Prosecutors said it was too early to disclose the results as the investigation was still ongoing, Reuters reported.
The case has also been referred to Belgium's intelligence watchdog, Commission R. President Vanessa Samen confirmed that VSSE reported the breach in June 2023, but the commission's findings remain confidential, The Brussels Times BT reports.
Intelligence sources indicate that in response to the breach, VSSE terminated its use of Barracuda products and recommended that affected employees renew their identity documents to prevent fraud.
While there are concerns that the stolen data could be sold on the dark web, no evidence of such activity has emerged. Officials are still unsure whether VSSE was the primary target or whether it fell within a larger espionage campaign.