The Institute of Tropical Medicine in Antwerp disclosed on Thursday 29 October 2026 that hackers copied personal and sensitive medical data of about 2,300 people from one of its servers. The institute detected suspicious activity on Monday 12 October 2026 on a server used for care applications and scientific research; external experts later established that an unknown third party had accessed the application and copied data.

What was taken

The stolen data is mostly research data, partly anonymised and pseudonymised, but identification cannot always be ruled out. It includes birth dates, postcodes and medical details such as diagnoses, treatments and sexual health data. Belgian outlets differ slightly on who was affected: some describe study participants, others research-project participants, and one notes it is unclear whether they are mainly staff or patients. The institute says most data cannot be linked to individuals, but for a limited number it can.

What happens next

The affected people have been informed by email; the affected server was taken offline immediately and internal security tightened. The institute says there are no signs the data has been spread or offered for sale, no ransom was demanded, and the attackers have not made contact. Care and teaching continue as normal, and the institute says the attack has no further impact on its general operations.

The incident was reported to Belgium's Centre for Cybersecurity and Data Protection Authority, and the institute has filed a complaint with police. For research institutions holding sensitive health data, the case is a reminder that pseudonymised data is not the same as anonymous data, and that a single server can hold enough detail to identify people.

Sources: Belgium Now and ITdaily.