Nobody Hacked The Print Shop

Every front desk keeps one list: who's staying, and what key they were given.

On 10 August, the print website Drukland told its customers that their account details may have been taken. Drukland was never the target.

• What went: email addresses, scrambled passwords, and for a small group of customers, credit card details. Simian notified those people by phone as well as email, reported the leak to the Dutch data protection authority (Autoriteit Persoonsgegevens), and filed a police report. The card details and the service-provider origin come from Security.NL, 11 August 2026; ITdaily's report of 10 August names only the email addresses and hashed passwords.
• Hashed is not the same as safe. A hash scrambles a password, but a weak or reused password behind that hash can still be cracked offline, at leisure, with nothing to slow the attacker down.
• You cannot audit what you do not know exists. A customer picked Drukland. They did not pick Simian, and they certainly did not pick Simian's service provider. That invisible third step is where this one actually happened, and it is the step almost nobody writes down.

ITdaily: Drukland cyberattack, customer data possibly stolen → https://itdaily.be/nieuws/beveiliging/cyberaanval-treft-drukland-klantgegevens-mogelijk-ontvreemd/

Platform Spotlight: Your Procedures Now Come Already Written

The forms used to come blank. They don't anymore.

The eleven procedure and policy documents your CyFun Basic programme generates now ship with real, usable content instead of empty skeletons:

• Purpose, scope, triggers, steps, evidence to keep, review cadence. Every document answers the question an auditor actually asks, not just the question a template usually asks.
• Nothing to translate, nothing to draft from scratch. Whichever language your team works in, the document reads like someone who understands your business wrote it, because that's what it's built to do.
• Existing organisations pick this up automatically on their next refresh, with nothing to regenerate by hand.

See your procedures → https://easycyberprotection.com/app

Patch Watch: The Side Door Everyone Forgot Was Open

Every building has a door reserved for staff. Attackers found the one nobody re-keyed.

Ransomware crews are exploiting two flaws in SonicWall's SMA1000, the device many companies use to let staff log in from outside.

• Patched in July, still being exploited in August. A device vulnerable in June can already be compromised even after it's patched later. Patching closes the door; it doesn't undo who already walked through it.
• Shadowserver tracks over 380 SMA1000 devices exposed online, weeks after the patch shipped, though some of those may already have been secured.
• A remote-access gateway is the front desk for your whole network. It's the one device deliberately built to accept connections from outside, which is exactly why it's worth more to an attacker than almost anything behind it.

BleepingComputer: CISA says SonicWall SMA1000 flaws are exploited by ransomware gangs → https://www.bleepingcomputer.com/news/security/cisa-sonicwall-sma1000-flaws-now-exploited-by-ransomware-gangs/

A Badge For The People Who Issue Badges

Some venues now check the credentials of whoever's running the door, not just the guests.

ENISA opened public consultation this week on a new EU certification scheme for cybersecurity services themselves.

• The consultation closes 13 September 2026. No scheme text is published yet, only the service profile and the three assurance tiers.
• If you outsource incident response, this is worth watching. An EU-recognised assurance level on your provider's incident-response service is one more thing you could point to when a client or insurer asks who's actually behind your security.
• Belgium's NCCA runs its own short questionnaire, in French and Dutch, for anyone who wants to help shape the scheme before it's finalised.

CCB: Shape the future of cybersecurity services in Europe (EUMSS consultation) → https://ccb.belgium.be/news/shape-future-cybersecurity-services-europe

T.A.R.S.: Hashed Isn't The Same As Safe

Once an issue, our in-house AI gets the floor.

Drukland's breach this week leaked email addresses and hashed passwords, and I want to push back gently on how safe "hashed" sounds.

Drukland's breach this week leaked email addresses and hashed passwords, and I want to push back gently on how safe "hashed" sounds. A hash is a one-way scramble, true. But it only protects a password that was hard to guess in the first place. Run a common password through any hash function and it's still that same common password to anyone with…

ITdaily: Drukland cyberattack, customer data possibly stolen → https://itdaily.be/nieuws/beveiliging/cyberaanval-treft-drukland-klantgegevens-mogelijk-ontvreemd/