{ "schema_version": "1.0", "country": { "code": "BE", "name": "Belgium", "preparedness_authority": { "name": "Nationaal Crisiscentrum (NCCN) — home", "url": "https://crisiscentrum.be/nl", "date": "2026-11-08", "note": "Standing site of the federal public-preparedness authority; date is the day it was read for this board." } }, "status": "active", "updated_at": "2026-11-08T10:35+01:00", "composite": { "score": 63, "previous_score": null }, "watch_level": { "level": "II", "previous": null, "since": "2026-11-08" }, "hazard_band": { "band": "high", "previous": null, "since": "2026-11-08", "basis": "Analysis, first assessment: Belgium hosts the institution holding about €200 billion of frozen Russian assets and would carry Russian claims and reprisals alone, which the prime minister treats as the central national risk; its airports and the port of Antwerp (a supply route for military materiel to Ukraine) have already been disrupted by drones; the government's own defence plan lists ports, cyber security, roads, waterways and health care as functions to keep running in a hybrid or military crisis; and the state is taking over an ageing nuclear fleet to reduce import dependence. A break in any of these would reach households and essential services quickly. Not 'severe' or 'extreme': the sources describe exposure and precaution, not a current failure.", "sources": [ { "name": "VRT NWS — Euroclear back on the table: four countries want to use €193 billion of Russian assets after all", "url": "https://www.vrt.be/vrtnws/nl/2026/09/02/bevroren-russische-miljarden-opnieuw-op-tafel-4-eu-landen-wille/", "date": "2026-09-02" }, { "name": "Nationaal Crisiscentrum — First National Defence Plan (Plan SHIELD) brings all governments together", "url": "https://crisiscentrum.be/nl/newsroom/historische-primeur-eerste-nationaal-verdedigingsplan-shield-genaamd-brengt-alle-overheden", "date": "2026-06-29", "note": "Date stated in the release text (signed Monday 29 June 2026)." }, { "name": "NOS (ANP) — Port of Antwerp to get air-defence system from next year", "url": "https://nos.nl/artikel/2604047-haven-van-antwerpen-krijgt-vanaf-volgend-jaar-luchtafweergeschut", "date": "2026-02-26" }, { "name": "NOS — Belgium wants to take over its nuclear reactors: dismantling halted, old reactors open", "url": "https://nos.nl/artikel/2612507-belgie-wil-kernreactoren-overnemen-ontmanteling-gestaakt-oude-reactoren-open", "date": "2026-04-30" } ] }, "story_stage": { "stage": "pressure", "previous": null, "since": "2026-11-08", "basis": "The Chief of Defence describes Belgium as the focus of a heightened hybrid threat with actions showing strong indications of Russian direction; the interior minister speaks of 'a kind of war'; confirmed incidents (drones over airports, bases and a nuclear plant; cyber attacks on the tax administration and supermarkets; a shadow-fleet boarding) stay below the threshold of armed conflict and none is officially attributed to a state. No crisis is declared and Plan SHIELD is explicitly a precaution, so not 'confrontation' or 'crisis'.", "sources": [ { "name": "VRT NWS (Belga) — Chief of Defence: 'Belgium seems to be the focus of a heightened hybrid threat'", "url": "https://www.vrt.be/vrtnws/nl/2025/11/12/chef-defensie-belgie-lijkt-focus-van-verhoogde-hybride-dreigin/", "date": "2025-11-12" }, { "name": "VRT NWS — Minister Quintin refuses to call the Leipzig drone incident a 'hybrid threat': 'That was an attack'", "url": "https://www.vrt.be/vrtnws/nl/2026/09/04/hybride-oorlog-aanval-bernard-quintin-afspraak/", "date": "2026-09-04" }, { "name": "Nationaal Crisiscentrum — First National Defence Plan (Plan SHIELD) brings all governments together", "url": "https://crisiscentrum.be/nl/newsroom/historische-primeur-eerste-nationaal-verdedigingsplan-shield-genaamd-brengt-alle-overheden", "date": "2026-06-29", "note": "Date stated in the release text (signed Monday 29 June 2026)." } ] }, "indicators": [ { "id": "cyber-government-services", "name": "Cyber attacks on federal government services", "domain": "cyber-critical-infrastructure", "level": 3, "previous_level": null, "last_change": "2026-11-08", "moved_this_update": false, "level_basis": "Level 3 (high): a confirmed attack on the federal tax administration took MyMinfin and other public services offline nationwide at the end of October 2026, fiscal deadlines had to be extended, and a VAT-registration backlog of 5,500 files was still open ten days later; the Crisiscentrum separately disclosed a security incident on infrastructure that carried passenger data. Not level 4: the authorities report no data theft and services were restarted; no national function is broken.", "summary": "The federal tax administration was hit by a cyber attack on 28 October 2026; parts of its online services were still not back on 7 November.", "bullets": [ { "text": "FOD Financiën (the federal tax administration) was the victim of a cyber attack; as a precaution, digital services such as MyMinfin were taken offline, so tax returns could temporarily not be consulted or filed, and deadlines were extended.", "kind": "fact", "attribution": "not-applicable", "source": { "name": "VRT NWS — Tax returns temporarily unavailable after cyber attack on FOD Financiën", "url": "https://www.vrt.be/vrtnws/nl/2026/10/28/cyberaanval-bij-fod-financien/", "date": "2026-10-28" } }, { "text": "Ten days later the online application for a VAT number was still not working; staff process applications by hand and the backlog stood at 5,500 files, against 20,000–30,000 (de)activations in a normal month. FOD Financiën says the attackers could not steal data.", "kind": "fact", "attribution": "not-applicable", "source": { "name": "VRT NWS — Start-ups still cannot apply for a VAT number after the cyber attack: '5,500 files waiting'", "url": "https://www.vrt.be/vrtnws/nl/2026/11/07/btw-nummer-cyberaanval-overheid/", "date": "2026-11-07" } }, { "text": "The Nationaal Crisiscentrum reported a security incident on an external infrastructure used between October 2025 and February 2026 to transfer certain passenger data; analyses so far show no evidence the data were consulted, copied or used, but that cannot be fully excluded. Travellers are asked to watch for phishing and identity fraud.", "kind": "official-claim", "attribution": "not-applicable", "source": { "name": "Nationaal Crisiscentrum — Information for passengers about a security incident", "url": "https://crisiscentrum.be/nl/newsroom/informatie-voor-passagiers-over-een-veiligheidsincident", "date": "2026-10-19", "note": "Date from the Crisiscentrum newsroom listing." } }, { "text": "Attribution of the FOD Financiën attack is open: the sources used here name no actor and the service has not published details of the attack itself.", "kind": "analysis", "attribution": "open", "source": { "name": "VRT NWS — Start-ups still cannot apply for a VAT number after the cyber attack: '5,500 files waiting'", "url": "https://www.vrt.be/vrtnws/nl/2026/11/07/btw-nummer-cyberaanval-overheid/", "date": "2026-11-07" } } ] }, { "id": "cyber-retail-cooling-sabotage", "name": "Sabotage of supermarket cooling systems", "domain": "cyber-critical-infrastructure", "level": 2, "previous_level": null, "last_change": "2026-11-08", "moved_this_update": false, "level_basis": "Level 2 (elevated): a confirmed incident with limited impact — cooling systems at Delhaize, Carrefour and Spar stores failed on 2 November 2026, with empty shelves and food losses, and the same wave was reported in Sweden and Estonia. Not level 3: stores reopened and no national function was affected; attribution rests on a claim by pro-Russian hackers, not on an official finding.", "summary": "Hackers disrupted the cooling systems of several Belgian supermarket chains on 2 November 2026; pro-Russian hackers claimed the attack.", "bullets": [ { "text": "Cooling systems failed at Delhaize, Carrefour and Spar stores; several shops opened with empty shelves. Delhaize first spoke of an 'IT failure', but with several chains hit, experts read it as a cyber attack through a service provider's management account. Reports also came from Sweden and Estonia; one Proxy Delhaize store put its loss at 'at least €60,000' of food.", "kind": "fact", "attribution": "open", "source": { "name": "VRT NWS — After the cyber attack on supermarket cooling systems: how, and who is behind it?", "url": "https://www.vrt.be/vrtnws/nl/2026/11/02/koelsystemen-verstoord-bij-onder-meer-delhaize-en-carrefour-hoe/", "date": "2026-11-02" } }, { "text": "The attacks on, among others, the supermarkets were claimed by pro-Russian hackers; VRT frames them among the hybrid attacks attributed to Russia and asks whether European sanctions still deter. No Belgian authority has published an attribution in the sources used.", "kind": "official-claim", "attribution": "open", "source": { "name": "VRT NWS — How should Europe respond to cyber attacks? (De Ochtend)", "url": "https://www.vrt.be/vrtnws/nl/2026/11/07/europa-rusland-cyberaanvallen-hoe-reageren/", "date": "2026-11-07" } }, { "text": "The incident sits in the pattern the Chief of Defence described a year earlier: cyber attacks, cable sabotage and disinformation 'with strong indications they are directed by Russia'.", "kind": "analysis", "attribution": "open", "source": { "name": "VRT NWS (Belga) — Chief of Defence: 'Belgium seems to be the focus of a heightened hybrid threat'", "url": "https://www.vrt.be/vrtnws/nl/2025/11/12/chef-defensie-belgie-lijkt-focus-van-verhoogde-hybride-dreigin/", "date": "2025-11-12" } } ] }, { "id": "hybrid-pressure-state-actors", "name": "Hybrid pressure on Belgium by state actors", "domain": "hybrid-influence", "level": 3, "previous_level": null, "last_change": "2026-11-08", "moved_this_update": false, "level_basis": "Level 3 (high): the Chief of Defence told parliament Belgium 'seems to be the focus of a heightened hybrid threat' and named actions 'with strong indications they are directed by Russia'; the interior minister says 'we are in a kind of war'; pro-Russian hackers claimed the November 2026 supermarket attack. Not level 4: no Belgian authority has attributed a specific incident on Belgian soil to a state, and the minister says there are no concrete indications of an attack like Leipzig in Belgium.", "summary": "The Chief of Defence calls Belgium a focus of heightened hybrid threat; the interior minister speaks of 'a kind of war' without concrete indications of an attack in Belgium.", "bullets": [ { "text": "Chief of Defence Frederik Vansina in the Chamber: 'At this moment Belgium seems to be the focus of a heightened hybrid threat', pointing to drones over airports and military sites, the cyber threat, ships off the coast and 'assertive rhetoric' online; he added that Europe sees 'actions with strong indications that they are directed by Russia', such as sabotage of undersea cables, cyber attacks and disinformation.", "kind": "official-claim", "attribution": "not-applicable", "source": { "name": "VRT NWS (Belga) — Chief of Defence: 'Belgium seems to be the focus of a heightened hybrid threat'", "url": "https://www.vrt.be/vrtnws/nl/2025/11/12/chef-defensie-belgie-lijkt-focus-van-verhoogde-hybride-dreigin/", "date": "2025-11-12" } }, { "text": "Interior minister Bernard Quintin on the foiled drone attack at Leipzig airport: 'That was an attack, full stop' rather than a 'hybrid threat'; 'we are in a kind of war', though he sees no concrete indications of a similar attack in Belgium.", "kind": "official-claim", "attribution": "not-applicable", "source": { "name": "VRT NWS — Minister Quintin refuses to call the Leipzig drone incident a 'hybrid threat': 'That was an attack'", "url": "https://www.vrt.be/vrtnws/nl/2026/09/04/hybride-oorlog-aanval-bernard-quintin-afspraak/", "date": "2026-09-04" } }, { "text": "The Russian embassy in Brussels denied 'any involvement' of Russian services in the drones over Belgian bases and airports and offered to discuss the matter directly; VRT reported that sources in the Belgian security services suspected Russia and linked it to Belgium's role in the debate on some €190 billion of frozen Russian assets.", "kind": "fact", "attribution": "open", "source": { "name": "VRT NWS — Russian embassy denies any involvement in drone operations in Belgium", "url": "https://www.vrt.be/vrtnws/nl/2025/11/05/rusland-ontkent-elke-betrokkenheid-bij-drone-operaties-in-belgie/", "date": "2025-11-05" } }, { "text": "After the November 2026 supermarket attack, claimed by pro-Russian hackers, the public debate in Belgium turned to whether sanctions still deter and whether Europe should 'hack back'. No Belgian authority has published an attribution of that attack in the sources used.", "kind": "analysis", "attribution": "open", "source": { "name": "VRT NWS — How should Europe respond to cyber attacks? (De Ochtend)", "url": "https://www.vrt.be/vrtnws/nl/2026/11/07/europa-rusland-cyberaanvallen-hoe-reageren/", "date": "2026-11-07" } } ] }, { "id": "drone-incursions-critical-sites", "name": "Drone incursions over airports, bases and a nuclear plant", "domain": "hybrid-influence", "level": 2, "previous_level": null, "last_change": "2026-11-08", "moved_this_update": false, "level_basis": "Level 2 (elevated): a persistent, confirmed pattern. The November 2025 wave had national-scale impact (Brussels Airport closed, up to a thousand passengers sleeping at the airport, drones over Kleine-Brogel, Florennes, Liège and the Doel nuclear plant) and would have been level 3 at the time; the September 2026 recurrences were limited (three flights diverted at Brussels Airport; the Charleroi drone was a private pilot who was caught). Attribution of the 2025 wave remains open. Raise to 3 on a new wave with national-scale disruption or an official attribution.", "summary": "A wave of drones closed Brussels Airport and overflew bases and the Doel nuclear plant in November 2025; smaller recurrences followed in September 2026.", "bullets": [ { "text": "On the evening of 3 November 2025 all air traffic at Brussels Airport was halted after a drone report (three drones seen, per VRT); some sixteen departing Brussels Airlines flights were cancelled, and drones were again seen over the Kleine-Brogel and Florennes air bases. The next morning 40 flights were cancelled and 500–1,000 passengers had spent the night at the airport.", "kind": "fact", "attribution": "open", "source": { "name": "VRT NWS — Air traffic at Brussels Airport halted by drones; sightings at Kleine-Brogel and Florennes bases", "url": "https://www.vrt.be/vrtnws/nl/2025/11/04/vliegverkeer-op-brussels-airport-stilgelegd-na-een-dronemelding/", "date": "2025-11-04" } }, { "text": "On 9 November 2025 three drones were seen over the Doel nuclear plant (operator Engie: no consequences for operations) and air traffic at Liège airport was halted twice the same evening.", "kind": "fact", "attribution": "open", "source": { "name": "NOS — Drones seen at Belgian nuclear plant Doel and Liège airport", "url": "https://nos.nl/artikel/2589862-drones-gezien-bij-belgische-kerncentrale-doel-en-luchthaven-luik", "date": "2025-11-09" } }, { "text": "Response: the Chief of Defence ordered that unknown drones over military bases may be jammed and shot down; the National Security Council decided to strengthen the National Air Security Centre at Beauvechain and buy counter-drone systems; the United Kingdom sent an anti-drone team.", "kind": "fact", "attribution": "not-applicable", "source": { "name": "NOS (AFP) — Belgium to strengthen air surveillance: 'If we can, we shoot them down'", "url": "https://nos.nl/artikel/2589433-belgie-gaat-luchtbewaking-versterken-als-het-kan-halen-we-ze-neer", "date": "2025-11-06" } }, { "text": "Recurrence: on 11 September 2026 landings at Brussels Airport were halted between 21:45 and 22:10 after a drone report (three flights diverted) and a drone was seen again the next evening; on 16 September a drone halted Charleroi airport for half an hour — a private drone, whose pilot was intercepted by police and faces a fine.", "kind": "fact", "attribution": "open", "source": { "name": "VRT NWS (Belga) — Drone seen near Brussels Airport for the second evening running", "url": "https://www.vrt.be/vrtnws/nl/2026/09/12/tweede-dag-op-rij-drone-waargenomen-boven-brussels-airport/", "date": "2026-09-12" } } ] }, { "id": "defence-posture-rebuild", "name": "Defence rebuild: air defence, F-35 fleet, allied deployments", "domain": "military-territorial", "level": 2, "previous_level": null, "last_change": "2026-11-08", "moved_this_update": false, "level_basis": "Level 2 (elevated): the government is rebuilding capabilities it had given up — very-short-range air defence returns after almost ten years, NASAMS is ordered for the port of Antwerp, eleven extra F-35s are under consideration and 330 troops rotate to NATO's eastern flank in Romania — explicitly because of a changed security context. Not level 3: these are posture decisions, not a mobilisation step or a declared threat to Belgian territory.", "summary": "Belgium is bringing back ground-based air defence, weighing eleven extra F-35s and sending 330 troops to Romania.", "bullets": [ { "text": "Defence: for almost ten years Belgium had no very-short-range air defence capability; it is now being rebuilt in layers — Mistral is back, NASAMS contracts were signed at the end of September 2026 and Serval is planned — and the page notes that drones were detected over Belgian military sites and airports.", "kind": "official-claim", "attribution": "not-applicable", "source": { "name": "Defensie (mil.be) — Mistral, NASAMS, Serval: air defence is back", "url": "https://www.mil.be/nl/news/mistral-nasams-serval-de-luchtverdediging-is-terug/", "date": "2026-10-07", "note": "Date printed on the page." } }, { "text": "Defence explains the planned expansion of the F-35 fleet from 34 to 45 aircraft (eleven additional F-35As under consideration) by the changed European security context and NATO deterrence; the F-16 fleet is to be out of service by 2028.", "kind": "official-claim", "attribution": "not-applicable", "source": { "name": "Defensie (mil.be) — Why Belgium is expanding its F-35 fleet to 45 aircraft", "url": "https://www.mil.be/nl/news/waarom-belgie-zijn-f-35-vloot-uitbreidt-tot-45-toestellen/", "date": "2026-10-28", "note": "Date printed on the page." } }, { "text": "Prime minister De Wever announced that the port of Antwerp — used, among other things, for the supply of American military materiel to Ukraine — will get a NASAMS air-defence system from next year, ordered together with the Dutch armed forces.", "kind": "fact", "attribution": "not-applicable", "source": { "name": "NOS (ANP) — Port of Antwerp to get air-defence system from next year", "url": "https://nos.nl/artikel/2604047-haven-van-antwerpen-krijgt-vanaf-volgend-jaar-luchtafweergeschut", "date": "2026-02-26" } }, { "text": "330 Belgian troops are preparing for a five-month rotation in Romania under the Carabiniers Prince Baudouin – Grenadiers battalion; separately, the delayed delivery of the Belgian-Dutch frigates by Damen is called 'a big problem' by the defence minister, who is looking at alternatives.", "kind": "fact", "attribution": "not-applicable", "source": { "name": "Defensie (mil.be) — 330 troops prepare for a five-month deployment to Romania", "url": "https://www.mil.be/nl/news/koers-richting-roemenie-330-militairen-bereiden-zich-voor-op-een-inzet-van-vijf-maanden/", "date": "2026-09-21", "note": "Date printed on the page." } } ] }, { "id": "maritime-shadow-fleet", "name": "Russian shadow fleet off the Belgian coast", "domain": "military-territorial", "level": 2, "previous_level": null, "last_change": "2026-11-08", "moved_this_update": false, "level_basis": "Level 2 (elevated): a confirmed incident with limited impact — the Belgian armed forces boarded a shadow-fleet tanker in Belgium's exclusive economic zone and brought it to Zeebrugge — and the Chief of Defence lists 'ships off our coast' among the hybrid pressures. Not level 3: one operation, no damage to Belgian infrastructure in the sources used.", "summary": "The Belgian army boarded a Russian shadow-fleet tanker off Ostend on 1 March 2026 and brought it to Zeebrugge.", "bullets": [ { "text": "The Belgian armed forces, with French help, boarded the tanker Ethera off Ostend, outside territorial waters but inside the exclusive economic zone. The public prosecutor said the ship was sailing under a false flag (Guinea) and was on its way back to Russia; the ship was brought to Zeebrugge and the crew held aboard pending the investigation.", "kind": "fact", "attribution": "not-applicable", "source": { "name": "NOS — Belgian army boards oil tanker of the Russian shadow fleet", "url": "https://nos.nl/artikel/2604457-belgisch-leger-entert-olietanker-van-russische-schaduwvloot", "date": "2026-03-01" } }, { "text": "The Chief of Defence named 'the ships off our coast' alongside drones and cyber among the elements of the heightened hybrid threat he described to parliament.", "kind": "official-claim", "attribution": "not-applicable", "source": { "name": "VRT NWS (Belga) — Chief of Defence: 'Belgium seems to be the focus of a heightened hybrid threat'", "url": "https://www.vrt.be/vrtnws/nl/2025/11/12/chef-defensie-belgie-lijkt-focus-van-verhoogde-hybride-dreigin/", "date": "2025-11-12" } } ] }, { "id": "nuclear-energy-control", "name": "State control of the nuclear fleet and energy dependence", "domain": "energy-resources", "level": 2, "previous_level": null, "last_change": "2026-11-08", "moved_this_update": false, "level_basis": "Level 2 (elevated): the government reversed the nuclear phase-out, halted dismantling and is negotiating to take the Doel and Tihange plants from Engie, stating the aim of less dependence on fossil imports and more control over supply; drones were seen over Doel in November 2025 without operational consequences. Not level 3: no supply disruption or crisis plan is in force in the sources used.", "summary": "Belgium stopped dismantling its nuclear plants and wants to take them over from Engie to reduce import dependence; drones overflew Doel in 2025.", "bullets": [ { "text": "Belgium stopped the dismantling of its nuclear plants with immediate effect and opened negotiations with Engie to take over the installations, prime minister De Wever announced; the aim is more secure, affordable and sustainable energy 'with less dependence on fossil imports' and more control over the country's own supply.", "kind": "fact", "attribution": "not-applicable", "source": { "name": "NOS — Belgium wants to take over its nuclear reactors: dismantling halted, old reactors open", "url": "https://nos.nl/artikel/2612507-belgie-wil-kernreactoren-overnemen-ontmanteling-gestaakt-oude-reactoren-open", "date": "2026-04-30" } }, { "text": "In May 2025 parliament removed the 2003 phase-out from the law; only two of seven reactors (Doel 3 and Tihange 2) had been shut, and the change lets the government in principle restart closed plants.", "kind": "fact", "attribution": "not-applicable", "source": { "name": "NOS — Belgian government reverses course: nuclear plants need not close", "url": "https://nos.nl/artikel/2567463-belgische-regering-maakt-draai-kerncentrales-hoeven-niet-te-sluiten", "date": "2025-05-15" } }, { "text": "Three drones were seen over the Doel nuclear plant on 9 November 2025; operator Engie reported no consequences for the plant's operation.", "kind": "fact", "attribution": "open", "source": { "name": "NOS — Drones seen at Belgian nuclear plant Doel and Liège airport", "url": "https://nos.nl/artikel/2589862-drones-gezien-bij-belgische-kerncentrale-doel-en-luchthaven-luik", "date": "2025-11-09" } } ] }, { "id": "euroclear-russian-assets-exposure", "name": "Euroclear: Russian claims on €200 billion of frozen assets", "domain": "economy-supply-chains", "level": 3, "previous_level": null, "last_change": "2026-11-08", "moved_this_update": false, "level_basis": "Level 3 (high): a Brussels institution holds about €200 billion of frozen Russian central-bank assets; Russian courts have ordered it to pay about €200–217 billion, allowed immediate enforcement and upheld the ruling on appeal, and nine oligarchs have opened arbitration against the Belgian state. The prime minister treats Belgian liability for Russian claims and reprisals as the central national risk. Not level 4: Euroclear does not recognise the Russian jurisdiction, no enforcement outside Russia is reported and Fitch kept its AA rating.", "summary": "Russian courts have ordered Brussels-based Euroclear to pay over €200 billion for the frozen assets it holds; Belgium wants no part of the liability.", "bullets": [ { "text": "A Russian court ordered Euroclear to pay about €200 billion in damages for the Russian central-bank assets frozen at the Brussels institution since the invasion; the trial was held behind closed doors and lawyers point out that Russian courts have no jurisdiction abroad. Frozen assets at Euroclear reached €200 billion in the first quarter of 2026.", "kind": "fact", "attribution": "not-applicable", "source": { "name": "VRT NWS (Belga) — Russian court orders Euroclear to pay about €200 billion", "url": "https://www.vrt.be/vrtnws/nl/2026/05/15/russische-rechtbank-eist-200-miljard-euro-van-euroclear/", "date": "2026-05-15" } }, { "text": "A Moscow court granted the Russian central bank immediate enforcement of its 18.2 trillion rouble (€217 billion) claim, which according to Bloomberg could let it pursue payment from Euroclear in Russia and other jurisdictions without waiting for the appeal.", "kind": "fact", "attribution": "not-applicable", "source": { "name": "VRT NWS (Belga) — Russian court lets the central bank enforce its claim against Euroclear immediately", "url": "https://www.vrt.be/vrtnws/nl/2026/05/26/russische-rechtbank-laat-centrale-bank-tegoeden-bij-euroclear-te/", "date": "2026-05-26" } }, { "text": "On appeal the Russian court upheld the order; Euroclear says it does not recognise the court's jurisdiction and that the claims are not recognised under European law, Fitch kept Euroclear's rating at AA, and Euroclear has sued the Russian central bank before the Brussels enterprise court.", "kind": "fact", "attribution": "not-applicable", "source": { "name": "VRT NWS (Belga) — Euroclear loses appeal in Russia, must pay over €200 billion according to Russian court", "url": "https://www.vrt.be/vrtnws/nl/2026/07/17/euroclear-belga/", "date": "2026-07-17" } }, { "text": "Nine Russian oligarchs opened arbitration against Belgium to recover money held at Euroclear, invoking 1989 and 1998 investment treaties of the Belgium-Luxembourg Economic Union; some 200 earlier procedures before the Council of State all upheld the freezes, according to FOD Financiën.", "kind": "fact", "attribution": "not-applicable", "source": { "name": "VRT NWS — Nine Russian oligarchs start arbitration to recover their fortunes held at Euroclear", "url": "https://www.vrt.be/vrtnws/nl/2026/05/05/russische-oligarchen-vallen-belgie-aan-over-geblokkeerde-fortuin/", "date": "2026-05-05" } } ] }, { "id": "terrorism-threat-level", "name": "National terrorism threat level (OCAD)", "domain": "social-cohesion-unrest", "level": 3, "previous_level": null, "last_change": "2026-11-08", "moved_this_update": false, "level_basis": "Level 3 (high): OCAD's general threat level for Belgium is 3 of 4 ('ernstig' — an attack is 'possible and probable'), unchanged through 2025 and reaffirmed in March 2026 with heightened vigilance for Israeli, Jewish, American and Iranian interests. OCAD 3/4 maps to board level 3; OCAD 4/4 ('imminent') would map to 4. Threat reports fell 26% in 2025, which does not move the level.", "summary": "OCAD keeps Belgium at threat level 3 of 4: an attack is 'possible and probable'.", "bullets": [ { "text": "OCAD's current general threat level for Belgium is 3 on a scale of 4 ('ernstig'): an attack is assessed as possible and probable; the assessment is in principle updated monthly.", "kind": "official-claim", "attribution": "not-applicable", "source": { "name": "OCAD — Algemene dreiging in België (current level page)", "url": "https://ocad.belgium.be/algemene-dreiging-in-belgie/", "date": "2026-10-06", "note": "Page's own modified stamp is 6 October 2026; read for this board on 8 November 2026." } }, { "text": "OCAD's 2025 annual report: the general level stayed at 3 throughout 2025 while both the number and the average seriousness of threat reports fell; the main threat remained jihadist, with right- and left-wing extremist milieus more active and radicalisation moving online.", "kind": "official-claim", "attribution": "not-applicable", "source": { "name": "OCAD — Jaarverslag 2025 (activity report)", "url": "https://ocad.belgium.be/publication/jaarverslag-2025/", "date": "2026-05-26", "note": "Date taken from the OCAD news item announcing the report." } }, { "text": "OCAD received 157 threat reports with a terrorism or extremism link in 2025, 26% fewer than the 213 of 2024; each report is assessed on a 1–4 scale for protective measures.", "kind": "fact", "attribution": "not-applicable", "source": { "name": "OCAD — Daling aantal dreigingsmeldingen, maar veiligheidscontext blijft complex", "url": "https://ocad.belgium.be/daling-aantal-dreigingsmeldingen-maar-veiligheidscontext-blijft-complex/", "date": "2026-02-06" } }, { "text": "On the Middle East conflict (March 2026) OCAD kept the general level at 3 ('serious threat') with heightened vigilance for Israeli, Jewish, American and Iranian interests, noting Iran's demonstrated ability to act in Europe directly or through proxies.", "kind": "official-claim", "attribution": "not-applicable", "source": { "name": "OCAD — Conflict in het Midden-Oosten: diensten volgen de situatie van nabij op", "url": "https://ocad.belgium.be/conflict-in-het-midden-oosten-diensten-volgen-de-situatie-van-nabij-op/", "date": "2026-03-13" } } ] }, { "id": "iran-linked-attacks-jewish-targets", "name": "Attacks on Jewish targets linked to Iran's call", "domain": "social-cohesion-unrest", "level": 2, "previous_level": null, "last_change": "2026-11-08", "moved_this_update": false, "level_basis": "Level 2 (elevated): confirmed incidents with limited physical impact — an explosion at a Liège synagogue (no injuries) and an arson in Antwerp's Jewish district under a terrorism investigation — which the OCAD director says answered Iran's call to strike Jewish and Israeli interests. Not level 3: no casualties, and the national level is carried by the OCAD indicator above.", "summary": "A synagogue explosion in Liège and an arson in Antwerp in March 2026 were, per OCAD's director, a response to Iran's call to attack Jewish targets.", "bullets": [ { "text": "An explosion at a synagogue in Liège around 04:00 on 9 March 2026 blew out the windows of the front facade; no one was injured. The mayor called it 'a violent act of antisemitism'.", "kind": "fact", "attribution": "open", "source": { "name": "NOS — Explosion at Liège synagogue: 'violent act of antisemitism'", "url": "https://nos.nl/artikel/2605612-explosie-bij-synagoge-luik-gewelddadige-daad-van-antisemitisme", "date": "2026-03-09" } }, { "text": "The Belgian prosecutor opened a terrorism investigation into two minors from Antwerp arrested over a car fire in the city's Jewish district on 23 March 2026; the fire was claimed by the same group that claimed recent attacks in Amsterdam and Rotterdam.", "kind": "fact", "attribution": "open", "source": { "name": "NOS (Reuters) — Terrorism investigation into two minors over arson in Antwerp's Jewish district", "url": "https://nos.nl/artikel/2607662-terrorismeonderzoek-naar-minderjarig-duo-om-brand-in-joodse-wijk-antwerpen", "date": "2026-03-24" } }, { "text": "OCAD director Gert Vercauteren: those behind the Liège and Antwerp attacks 'certainly answered the call from Iran' to hit Jewish and Israeli interests worldwide; threat reports had been normalising until 'the geopolitical situation, in particular the Iran war, intervened'.", "kind": "official-claim", "attribution": "open", "source": { "name": "Welingelichte Kringen (ANP/Belga) — OCAD director: Liège and Antwerp attacks answered Iran's call", "url": "https://www.welingelichtekringen.nl/samenleving/belgische-dienst-aanslagen-luik-en-antwerpen-door-oproep-iran", "date": "2026-09-24", "note": "Agency copy (ANP/Belga) of a radio interview; the OCAD site carries no written version of the statement." } } ] }, { "id": "eu-frozen-assets-friction", "name": "Friction with EU partners over the Russian assets at Euroclear", "domain": "diplomatic-alignment", "level": 2, "previous_level": null, "last_change": "2026-11-08", "moved_this_update": false, "level_basis": "Level 2 (elevated): Belgium blocked the EU plan to turn the Russian assets into a loan for Ukraine in December 2025 and the question was reopened by four member states in September 2026; the government demands unlimited guarantees from partners it has not received. Not level 3: Belgium remains inside the EU consensus (the €90 billion loan) and the prime minister says the Commission will not reopen the debate.", "summary": "Belgium stood alone in December 2025 to keep the Russian assets untouched; four EU states reopened the question in September 2026.", "bullets": [ { "text": "After a summit of more than 15 hours, EU leaders agreed to borrow €90 billion for Ukraine over two years instead of using the frozen Russian central-bank assets at Euroclear — the outcome prime minister De Wever had fought for, saying financial stability was the real winner.", "kind": "fact", "attribution": "not-applicable", "source": { "name": "VRT NWS — De Wever prevails after 15-hour summit: Russian assets stay untouched, EU borrows €90 billion", "url": "https://www.vrt.be/vrtnws/nl/2025/12/19/europese-unie-akkoord-lening-oekraine/", "date": "2025-12-19" } }, { "text": "Nine months later the Netherlands, Poland, Spain and Sweden asked the Commission for a solution to use the €193 billion after all; Belgium does not want to bear legal claims and Russian reprisals alone and demands unlimited solidarity from other member states.", "kind": "fact", "attribution": "not-applicable", "source": { "name": "VRT NWS — Euroclear back on the table: four countries want to use €193 billion of Russian assets after all", "url": "https://www.vrt.be/vrtnws/nl/2026/09/02/bevroren-russische-miljarden-opnieuw-op-tafel-4-eu-landen-wille/", "date": "2026-09-02" } }, { "text": "A proposal called 'The Russian Transfer' would let the EU take the assets away from Euroclear by regulation and manage them itself, removing Belgium's exposure to Russian claims; not everyone sees merit in it.", "kind": "analysis", "attribution": "not-applicable", "source": { "name": "VRT NWS — 'The Russian Transfer': how the EU could take over Russia's billions at Euroclear", "url": "https://www.vrt.be/vrtnws/nl/2026/09/27/kan-de-eu-de-russische-tegoeden-van-euroclear-overnemen-en-belgi0/", "date": "2026-09-28" } }, { "text": "De Wever told the Chamber he is 'certain' the Commission will not propose a new operation tied to the Russian assets to cover Ukraine's financing needs, 'because that is what was said'.", "kind": "official-claim", "attribution": "not-applicable", "source": { "name": "VRT NWS (Belga) — De Wever 'certain' the Commission will not reopen the Russian-assets debate", "url": "https://www.vrt.be/vrtnws/nl/2026/10/21/premier-de-wever-zeker-dat-europese-commissie-debat-over-russi/", "date": "2026-10-21" } } ] }, { "id": "civil-preparedness-posture", "name": "Civil-military preparedness: Plan SHIELD and 'Samen voorbereid'", "domain": "legal-emergency-powers", "level": 2, "previous_level": null, "last_change": "2026-11-08", "moved_this_update": false, "level_basis": "Level 2 (elevated): the federal state and the regions signed the first National Defence Plan since the Cold War (Plan SHIELD) for hybrid and military crisis scenarios and launched a four-year public-preparedness campaign; the Crisiscentrum calls SHIELD 'a precaution, not a reaction to an acute threat'. Not level 3: no emergency powers are invoked and no crisis is declared.", "summary": "Belgium adopted its first national defence plan since the Cold War on 29 June 2026, as a precaution; a four-year household-preparedness campaign runs alongside.", "bullets": [ { "text": "Defence and the Nationaal Crisiscentrum, with the federal departments and the regions, drew up the National Defence Plan (Plan SHIELD) for the first time since the end of the Cold War; it was signed on 29 June 2026 at an interministerial conference on resilience as the framework for 'extreme security circumstances'.", "kind": "fact", "attribution": "not-applicable", "source": { "name": "Nationaal Crisiscentrum — First National Defence Plan (Plan SHIELD) brings all governments together", "url": "https://crisiscentrum.be/nl/newsroom/historische-primeur-eerste-nationaal-verdedigingsplan-shield-genaamd-brengt-alle-overheden", "date": "2026-06-29", "note": "Date stated in the release text (signed Monday 29 June 2026)." } }, { "text": "The Crisiscentrum: Plan SHIELD covers continuity of ports, cyber security, roads, waterways and health care in hybrid and military crisis scenarios and lets the country scale up quickly; 'the plan is a precaution, not a reaction to an acute threat'.", "kind": "official-claim", "attribution": "not-applicable", "source": { "name": "Nationaal Crisiscentrum — First National Defence Plan (Plan SHIELD) brings all governments together", "url": "https://crisiscentrum.be/nl/newsroom/historische-primeur-eerste-nationaal-verdedigingsplan-shield-genaamd-brengt-alle-overheden", "date": "2026-06-29", "note": "Date stated in the release text (signed Monday 29 June 2026)." } }, { "text": "On 21 April 2026 the Crisiscentrum launched the four-year 'Samen voorbereid' campaign; in 2025 BE-Alert sent 2,190,000 text messages and 861,000 e-mails in emergencies, which the centre cites as proof that emergencies do not only happen to others.", "kind": "fact", "attribution": "not-applicable", "source": { "name": "Nationaal Crisiscentrum — 'Samen voorbereid': national resilience campaign launched", "url": "https://crisiscentrum.be/nl/newsroom/samen-voorbereid-het-nationaal-crisiscentrum-lanceert-een-grote-nationale", "date": "2026-04-21", "note": "Date stated in the release text (launch on 21 April)." } }, { "text": "A 'Samen voorbereid' brochure followed on 1 October 2026 with practical guidance on sheltering, finding reliable information, the emergency kit, a household plan and helping vulnerable people.", "kind": "fact", "attribution": "not-applicable", "source": { "name": "Nationaal Crisiscentrum — 'Samen voorbereid' brochure to prepare people for emergencies", "url": "https://crisiscentrum.be/nl/newsroom/samen-voorbereid-nationaal-crisiscentrum-lanceert-brochure-om-mensen-voor-te-bereiden-op", "date": "2026-10-01", "note": "Date printed on the page." } } ] } ], "household": { "what_changed": "This is the first assessment, so nothing on the board moved. The most recent items: on 28 October 2026 a cyber attack on the federal tax administration took MyMinfin and other online services down, and a VAT-registration backlog of 5,500 files was still open on 7 November; on 2 November hackers disrupted the cooling systems of Delhaize, Carrefour and Spar stores, an attack claimed by pro-Russian hackers. OCAD keeps the terrorism threat level at 3 of 4. The Russian assets at Euroclear remain the country's largest single exposure.", "why_it_matters": "The incidents of the last two weeks show what a hybrid or cyber incident looks like at home in Belgium: a government portal you cannot log in to, a supermarket with empty cooling shelves, a flight that does not leave. The Crisiscentrum's own advice is built for exactly that — being able to manage for about three days without electricity, water, internet or shops — and for knowing where official information comes from when something happens.", "prepare": [ { "text": "Keep an emergency kit at home for at least 72 hours: 3–10 litres of water per person per day, long-life food that needs no water, gas or electricity to prepare, a battery or wind-up radio, a torch, a charged power bank, a first-aid kit, a reserve of essential medicines and some cash for when card payments and cash machines are down.", "source": { "name": "Nationaal Crisiscentrum — Een noodpakket bij je thuis", "url": "https://crisiscentrum.be/nl/wat-kan-jij-doen/maak-een-noodpakket/een-noodpakket-bij-je-thuis", "date": "2026-11-08", "note": "Standing page; date is the day it was read for this board." } }, { "text": "Make a household plan: how you reach or meet each other if phones and internet are down, who collects the children, who in your street needs extra help — and talk it through with neighbours, your school or your workplace.", "source": { "name": "Nationaal Crisiscentrum — Maak een plan", "url": "https://crisiscentrum.be/nl/wat-kan-jij-doen/maak-een-plan", "date": "2026-11-08", "note": "Standing page; date is the day it was read for this board." } }, { "text": "Register on BE-Alert, the government's alert system, so that official warnings reach you by text, e-mail or phone in an emergency in your area.", "source": { "name": "BE-Alert — the government's alert system (home)", "url": "https://www.be-alert.be/nl", "date": "2026-11-08", "note": "Standing page; date is the day it was read for this board." } }, { "text": "Read the 'Samen voorbereid' brochure (October 2026) for the official guidance on sheltering, finding reliable information and helping vulnerable people.", "source": { "name": "Nationaal Crisiscentrum — 'Samen voorbereid' brochure to prepare people for emergencies", "url": "https://crisiscentrum.be/nl/newsroom/samen-voorbereid-nationaal-crisiscentrum-lanceert-brochure-om-mensen-voor-te-bereiden-op", "date": "2026-10-01", "note": "Date printed on the page." } }, { "text": "If you travelled internationally between October 2025 and February 2026, the Crisiscentrum asks you to be alert to unexpected e-mails, texts or calls asking for personal data, not to click suspicious links and never to share passwords or security codes.", "source": { "name": "Nationaal Crisiscentrum — Information for passengers about a security incident", "url": "https://crisiscentrum.be/nl/newsroom/informatie-voor-passagiers-over-een-veiligheidsincident", "date": "2026-10-19", "note": "Date from the Crisiscentrum newsroom listing." } } ] }, "changelog": [ { "date": "2026-11-08", "note": "First assessment. Twelve indicators across eight domains, all first-set (no movement). Sources: OCAD (threat level page, Jaarverslag 2025, news), Nationaal Crisiscentrum (Plan SHIELD, 'Samen voorbereid', noodpakket and plan pages, passenger-data incident), Defensie (mil.be), VRT NWS, NOS, BE-Alert; one ANP/Belga agency item for the OCAD director's radio statement. Research pack by Pollen_M5; every URL re-fetched by the builder before inclusion." } ], "notes": "Sourced-only board. Known gaps kept open on purpose: no Belgian authority has attributed the FOD Financiën attack, the supermarket sabotage or the 2025 drone wave to a state (the Russian embassy denies involvement); the Staatsveiligheid (VSSE) 2026 hack, the reported €700 million cruise-missile purchase and the minister's 'dozens of hybrid incidents' count sit only behind paywalled or consent-gated press and are not on the board; Euroclear figures (€185–217 billion) vary by source and date. Dutch quotes are paraphrased in English; the linked pages carry the original wording." }