#belgacomhack the source of the problem, the Belgacom mailserver was already known as a problem
"In the summer 2012, system administrators detected errors within Belgacom’s systems. At the company’s offices on Lebeau Street in Brussels, a short walk from the European Parliament’s Belgian offices, employees of Belgacom’s BICS subsidiary complained about problems receiving emails. The email server had malfunctioned, but Belgacom’s technical team couldn’t work out why.
The glitch was left unresolved until June 2013, when there was a sudden flare-up. After a Windows software update was sent to Belgacom’s email exchange server, the problems returned, worse than before. The administrators contacted Microsoft for help, questioning whether the new Windows update could be the reason for the fault. But Microsoft, too, struggled to identify exactly what was going wrong. There was still no solution to be found. (Microsoft declined to comment for this story.)
we found that the mailserver was an open relayserver which made it possible for anybody to send mails to anybody with any domain without being the owner of it (and that probably could have been used by the internal hackers to send internal mails)
and Belgacom found that normal ..... in march 2013
the external mailserver was already several times blacklisted as spammer or was infected between 2008 and 2013 which makes it naturally a logical victims for attacks - as it seems that the security of the machine is not necessarily uptodate (wrong or not)
so we were as surprised that this was maybe the digital beachhead of the penetration as we were when we were told that the NMBS used a year later the same insecure platform to place the data of one million clients it had hosted internal data a year before (and didn't bring it down afterwards)