Statement by the Institute of Tropical Medicine on a cyber incident
On Monday 12 October 2026, the Institute of Tropical Medicine (ITM) detected suspicious activity on a server hosting an application used for certain care services at our outpatient clinic and for scientific research. ITM immediately took the server offline and launched an internal investigation, supported by external cybersecurity and forensic experts.
The investigation has so far shown that an unauthorised third party gained access to a database of this application and copied data from it. Most of this data is pseudonymised: individuals appear in it under a code, without a name. For a limited number of people, data that can be used to identify them was also affected. According to current findings, ITM's other systems have not been affected. Patient care and teaching continue as normal.
ITM has reported the incident to the competent authorities, including the Data Protection Authority and the Centre for Cybersecurity Belgium, and has filed a complaint with the police. The individuals at greatest risk are being informed personally, either directly or through our research partners.
Be alert to unexpected emails, text messages or phone calls that refer to this incident, or in which someone asks for personal or medical information or for a payment. ITM never asks for passwords or bank details. Unsure whether a message comes from ITM? Please contact us yourself using the details below.
The investigation is still ongoing. We sincerely regret this incident. Protecting the data of our patients, study participants and partners remains an absolute priority for ITM. We continue to take measures to strengthen security as far as possible.
Published on 28 October 2026 – last updated on 29 October 2026
Contact
Do you have questions? Please contact our Data Protection Officer.