Startup Blog for First Time Entrepreneurs who Bootstrap

Supplier Data Breach: What a Small Business Does in the First 72 Hours, Lessons From the Vanden Broele Cyberattack

TL;DR: What does a small business do after a supplier data breach?

When a software supplier that holds your customers' data gets hacked, the GDPR duties sit with you, the data controller. Get the facts in writing, log every step, decide within 72 hours whether to notify your data protection authority and warn customers about fake payment requests.

Developing story. Last updated 27 Oct 2026, 15:55 CET. We'll update this article as Vanden Broele, the municipalities and the Belgian authorities publish more.

A supplier data breach lands on your desk the moment a tool you pay for gets hacked, and the Vanden Broele cyberattack on Belgian municipalities shows how it plays out; our hub article has the full story. This guide covers the customer side, for founders, freelancers and small businesses whose data sits in someone else's software.

What we know so far

The supplier: Belgian software company Vanden Broele was hacked. The affected product, eSignFlow, lets more than 120 local authorities have documents signed digitally, according to VRT NWS.
The data: mainly metadata, the signer's name with the document title. CEO Bram Van Impe says "the situation differs greatly per municipality".
The response: the company closed the access, replaced all access credentials and software connections, and reported the incident to the Centre for Cybersecurity Belgium (CCB), the data protection authority and the police.
The warnings: Genk, Peer, Hasselt, Steenokkerzeel, Leopoldsburg, Sint-Truiden and Beringen told residents to watch for phishing.

What we don't know yet

How many municipalities were affected, and which ones.
How the attacker got in, and who it was.
Exactly which data leaked per municipality, and whether other systems were reached.
Whether the CCB or the data protection authority will publish a statement.

Timeline

22 and 23 Oct 2026: the intrusion, according to ICT Magazine.
Fri 23 Oct: Vanden Broele spots suspicious activity in the morning and takes eSignFlow offline around midday.
Sat 24 Oct, evening: the hole is closed; the app returns with some restrictions.
Mon 26 Oct: the hack becomes public and municipalities warn residents.
Tue 27 Oct: ITdaily reports Steenokkerzeel residents have been unable to sign through eSignFlow since the weekend.

Who is responsible when your software supplier is breached?

GDPR splits the roles. The business that decides why and how personal data is used is the data controller. The software company that stores or handles that data on its behalf is the processor. Your booking tool, invoicing app, CRM or e-signature service is a processor, and you are the controller for your customers' data inside it.

GDPR rule	Who acts	Tells whom	Deadline
Art. 33(2)	Your supplier	You	Without undue delay after it becomes aware
Art. 33(1)	You	Your data protection authority	Within 72 hours of becoming aware, unless the breach is unlikely to put people at risk
Art. 34	You	The people affected	Without undue delay, when the risk to them is high
Art. 33(5)	You	Your own breach records	Every breach, reported or not

The 72 hours in Article 33 start when you become aware, and Article 33(4) lets you send information in phases while the supplier is still investigating. In Belgium you file through the data protection authority's portal in Dutch, French or German; notifications sent by email are not processed.

What should you do in the first 72 hours?

Get the facts (hours 0 to 4). Email the supplier your questions and note the time you first heard.
Lock your side (hours 4 to 24). Change passwords on that tool, revoke API tokens, disconnect linked apps and switch on two-factor login.
Judge the risk (day 1 to 2). Names with document titles carry less risk than ID numbers or bank details.
Notify and warn (by hour 72). File with the authority if people are at risk, tell them directly if the risk is high, and send every customer a phishing warning.

Which questions should you ask your supplier?

Push on connections to other software: in Belgium, Cipal Schaubroeck said its own systems escaped the hack, while some of its interfaces connect to the signature module. If the answer is "we are still investigating", log it and keep your own 72-hour clock running.

What should you write down for your own records?

Article 33(5) says the controller documents every personal data breach: the facts, its effects and the remedial action taken. Our data security practices for startups help you keep it in one place. Your log needs:

the date and time you learned about the breach, and from whom;
every supplier answer, with its date;
which customers, staff or records are affected, and what kind of data;
your risk decision and the reasons, including why you didn't notify if you didn't;
what you changed, who you told and when.

How do you warn customers about phishing after a supplier breach?

Stolen names and document titles are enough to write a convincing fake email. Belgian municipalities warned residents about messages asking for personal data, payment details, passwords or codes, above all fake requests to pay a GAS 5 fine, the municipal parking fine. Peer's advice, via ITdaily, fits any small business: "If in doubt: do not respond, do not click and do not pay. Check first."

Here is a short message you can adapt and send the same day:

Subject: Security notice about [supplier]

Hi [first name], our supplier [supplier] reported a security incident on [date]. We are checking what it means for your data and will update you by [date]. We will never ask you for a password, a code or a payment to new bank details. If a message from us looks unexpected, call us on [number] before you click or pay. [Your name]

Leave out "your data is safe" until the supplier confirms it in writing. If the risk is high, Article 34 asks you to tell people in clear and plain language, with the likely consequences, your measures and a contact point.

Which clauses belong in your processor agreement?

Article 28 requires a written contract with every processor, covering the subject, duration and purpose of the processing, and lists what the processor must do. It sets no hour count for the breach notice, so add your own.

What Article 28 requires	Clause to add (our suggestion)
Security measures under Article 32	Two-factor login for admin accounts, encryption and access logs
Help with your duties under Articles 32 to 36, breach notices included	Breach notice to you within 24 hours, a named contact and written updates
New sub-processors only with your written authorisation	A current list of sub-processors and notice before any change
Delete or return your data when the service ends	A deadline in days and written confirmation
Information and audits to show compliance	A written incident report after any breach that touches your data

Source: GDPR Article 28. More in our Ogi Networks data breach article and our GDPR guide for European startups.

Does Belgium's NIS2 law apply to a small business?

Belgium's NIS2 law of 26 April 2024 covers organisations in listed sectors with 50 or more staff, or more than €10 million in turnover or balance sheet, so most small businesses fall outside it. Entities in scope warn the CCB within 24 hours and notify within 72 hours. That notice doesn't replace the GDPR notice to the data protection authority.

What this means for you

List every supplier that holds customer or staff data, with its security contact. Third-party software was also the way in during the Cathedral Anthropic security test.
Check each processor contract against Article 28 and add a breach notice deadline.
Save a breach log template and the customer warning above in a shared folder.
Bookmark your authority's notification page, so nobody searches for it in hour 70.
Agree one team rule: no payment to new bank details without a phone check.
Turn on two-factor login everywhere; our cybersecurity guide for non-technical entrepreneurs shows how.

Building your first startup on a budget?

The Fe/male Switch startup game takes you from idea to first paying customers in weekly quests, with an AI co-founder and a community of founders.

👉 Start the game

FAQ: supplier data breach

What is a supplier data breach?

A security incident at a company that processes personal data for you, such as a SaaS tool or IT provider, where your customers' or staff's data is accessed, copied, lost or changed.

Who reports a supplier data breach under GDPR?

You, the data controller, notify your data protection authority within 72 hours of becoming aware, unless people are unlikely to be at risk. Your supplier must tell you without undue delay.

When does the 72-hour clock start?

When you become aware of the breach, which for most small businesses is the moment the supplier's notice reaches you.

Do I have to tell my customers?

Under Article 34, yes when the breach is likely to put them at high risk. A phishing warning is a sensible step either way.

What happened at Vanden Broele?

Its eSignFlow signature module was hacked on 22 and 23 October 2026, exposing mainly signer names and document titles. Municipalities warned residents about phishing.

Does the Belgian NIS2 law apply to my small business?

Most businesses with fewer than 50 staff and under €10 million in turnover or balance sheet fall outside it. GDPR breach rules apply either way.