#CyberWeekly

Every front desk keeps one list: who's staying, and what key they were given.

On 10 August, the print website Drukland told its customers that their account details may have been taken. Drukland was never the target. The break-in came in through a service provider of its parent company Simian, which also runs Reclameland and Flyerzone. Three companies away from the customer who placed the order.

• What went: email addresses, scrambled passwords, and for a small group of customers, credit card details. Simian notified those people by phone as well as email, reported the leak to the Dutch data protection authority (Autoriteit Persoonsgegevens), and filed a police report. The card details and the service-provider origin come from Security.NL, 11 August 2026; ITdaily's report of 10 August names only the email addresses and hashed passwords.
• Hashed is not the same as safe. A hash scrambles a password, but a weak or reused password behind that hash can still be cracked offline, at leisure, with nothing to slow the attacker down.
• You cannot audit what you do not know exists. A customer picked Drukland. They did not pick Simian, and they certainly did not pick Simian's service provider. That invisible third step is where this one actually happened, and it is the step almost nobody writes down.

What this means for you: ask your suppliers who they depend on. If a supplier cannot name the companies that touch your data, that is the answer. Start with the list you already have: our guide on passwords that actually hold up closes the reuse door on your side, and it is the cheapest half of this.

The forms used to come blank. They don't anymore.

The eleven procedure and policy documents your CyFun Basic programme generates now ship with real, usable content instead of empty skeletons: security monitoring, backup, change management, risk management, business continuity, and more. Each one is written for how a small business actually runs (Microsoft 365, a small IT team, no dedicated security staff), in English, Dutch and French. You fill in the who and the when; the what, why and how are already there.

• Purpose, scope, triggers, steps, evidence to keep, review cadence. Every document answers the question an auditor actually asks, not just the question a template usually asks.
• Nothing to translate, nothing to draft from scratch. Whichever language your team works in, the document reads like someone who understands your business wrote it, because that's what it's built to do.
• Existing organisations pick this up automatically on their next refresh, with nothing to regenerate by hand.

If a breach notice like Drukland's landed in your inbox tomorrow, is there a written procedure that says who calls whom, in what order? See what a real incident-response procedure should contain.

Every building has a door reserved for staff. Attackers found the one nobody re-keyed.

Ransomware crews are exploiting two flaws in SonicWall's SMA1000, the device many companies use to let staff log in from outside. The flaws, CVE-2026-15409 and CVE-2026-15410, were patched in mid-July after being used in attacks as far back as 22 June, when a threat actor tracked as UTA0533 deployed custom malware (KNUCKLEBALL, Sou5, ROOTRUN, ORANGETAIL) on vulnerable devices. CISA added both CVEs to its Known Exploited Vulnerabilities catalogue on 14 July, ordering US federal agencies to patch within three days, and has since flagged them as used by ransomware gangs.

• Patched in July, still being exploited in August. A device vulnerable in June can already be compromised even after it's patched later. Patching closes the door; it doesn't undo who already walked through it.
• Shadowserver tracks over 380 SMA1000 devices exposed online, weeks after the patch shipped, though some of those may already have been secured.
• A remote-access gateway is the front desk for your whole network. It's the one device deliberately built to accept connections from outside, which is exactly why it's worth more to an attacker than almost anything behind it.

Ask your IT partner one question this week: which device handles remote access into our network, is it on the current version, and has anyone checked whether it was reachable while it was still vulnerable? "We patched it" and "we checked whether we were already in trouble" are two different answers. See our notes on securing remote access.

Some venues now check the credentials of whoever's running the door, not just the guests.

ENISA opened public consultation this week on a new EU certification scheme for cybersecurity services themselves. Not the company being protected, but the company doing the protecting. The European Union Managed Security Services Scheme (EUMSS) starts with incident-response services and defines three assurance levels: Basic, Substantial, High. It runs alongside CyFun rather than replacing it. CyFun still certifies your organisation; EUMSS would certify the security provider you hire.

• The consultation closes 13 September 2026. No scheme text is published yet, only the service profile and the three assurance tiers.
• If you outsource incident response, this is worth watching. An EU-recognised assurance level on your provider's incident-response service is one more thing you could point to when a client or insurer asks who's actually behind your security.
• Belgium's NCCA runs its own short questionnaire, in French and Dutch, for anyone who wants to help shape the scheme before it's finalised.

Nothing changes for you today. Worth a line in the diary for mid-September, when the shape of it gets clearer. See where CyFun certification already stands.

Once an issue, our in-house AI gets the floor.

Not sure where MFA is still missing in your business? Start with two-factor authentication.