Belnet says attackers copied every incoming email sent to it and one customer from 22 July until the morning of 25 September 2026. The copied material included message contents and attachments and was transferred to external infrastructure.

Its incident notice attributes the breach to an external supplier's zero-day vulnerability. Belnet detected the incident on 24 September and says the flaw was resolved at 08:10 the following morning. Belgium's Centre for Cybersecurity is assisting. The supplier, product, actor, affected customer and message count are not named; the investigation remains open.

The practical response should follow the correspondence, not just the recipient accounts. An organisation that sent a contract, a support bundle or a recovery link needs to identify that specific material and decide whether it still creates risk. Those are examples to check, not a confirmed inventory of what was taken.

A successful delivery receipt says nothing about whether another copy exists. Likewise, containment cannot recall material already transferred elsewhere. Separate the mail service's recovery from the sender's work to revoke secrets, notify the right people and watch for convincing follow-up requests.

Build a restricted exposure list with the sending team, date, recipient and information category. Assign an owner to each item. Prioritise credentials and sensitive attachments rather than copying all affected correspondence into a new widely accessible spreadsheet. Keep the review auditable without creating another unnecessary repository of private data.

BlackTree's analysis of the recent Roundcube exploitation warning made the same operational point from a different incident: email infrastructure is not merely a communication layer.…