Credit: Steven Miller, Chronicle.lu
On Friday 7 August 2026, Luxembourg’s Ministry of Mobility and Public Works reported that a cybersecurity incident had affected the mConcept.lu website on Monday 3 August.
According to the ministry, the cyberattack was detected by the website’s security monitoring systems and the incident was immediately subject to technical investigations and remediation measures, allowing it to be quickly brought under control.
The ministry reported that the analyses carried out with the technical service provider responsible for the website confirmed the use of an administrator account fraudulently created by an unauthorised third party. The mechanism that enabled this creation was identified and neutralised. No legitimate accounts or any other unauthorised access to the system were identified.
The incident potentially concerns around 40 records originating from the website’s contact form. The data concerned is limited to professional contact details.
At this stage, the ministry said there is no indication that this data was accessed, copied or used improperly. However, in accordance with the precautionary principle and the requirements of the General Data Protection Regulation (GDPR), the ministry is treating this incident as a potential personal data breach.
It added that the necessary measures were implemented without delay, including the deletion of fraudulent accounts and malicious components identified, among other actions. The website has been fully cleaned and remains fully operational. No impact has been observed on the continuity of services provided to the public.
The potentially affected individuals and companies have been informed directly. The ministry reported it has also initiated the required procedures with the National Commission for Data Protection (CNPD), with the notification having been submitted within the deadlines set by the GDPR.
At present, the risk to the affected individuals is considered limited, taking into account the nature of the data concerned, the restricted number of records and the absence of evidence indicating malicious use of the information.
The ministry stressed it remains fully committed to ensuring the security of its information systems and the protection of the data entrusted to it.
The mConcept service solution for sustainable mobility has provided services to public bodies and businesses since 2014. Supported by public authorities, the service is based primarily on raising awareness through information and communication about alternative methods of transport.
