Editorial

“Both are about the distance between having the information somewhere and being able to produce it when somebody asks. That distance is what an audit actually measures, and it is almost never a technology problem. It…

WEBA customer data stolen?

August is the season of lists. The trouble starts when somebody else reads yours out loud.

Is this you?

• WEBA said early what an honest company says. Names, addresses, e-mail addresses and phone numbers may be involved, and the exact scope was not yet clear. The stores in Gent, Deinze, Mons and Tongeren were taken offline on purpose, examined, re-secured with IT partners, and reopened. That part worked.
• Listed is not the same as published. A leak-site entry is the pressure step: pay, or the files go up. At the time of writing the data has not been posted. The listing is recorded by leak-site trackers (ransomware.live logs the victim page at 16 August, 15:58 UTC). It is the crew's claim, not a WEBA statement.
• Getting the shop open is the easy half. Restoring systems is a job with a finish line. Working out exactly which records left the building is slow forensic work, and it is the half that decides what you have to tell your customers, and when.

ITdaily: furniture chain WEBA hit by cyberattack, customer data stolen → https://itdaily.be/nieuws/beveiliging/meubelketen-weba-getroffen-door-cyberaanval-klantgegevens-gestolen/

Nobody can audit CyFun Essential

The other kind of list: the official one, with a line on it that cannot be ticked.

Is this you?

• If you are a supplier, this arrives as paperwork. An organisation that has to evidence Important-level compliance by next April evidences part of it through the companies it buys from. The questionnaire is the delivery mechanism, and it does not care how small you are.
• Here is the part nobody is saying out loud. The CCB's own list of authorised bodies, in its current version, names four organisations allowed to verify CyFun. All four are approved for Basic through Important. None is approved for Essential. The certificate meant to be held next April cannot be bought today, from anyone, at any price.
• So read April 2027 as an Important-level deadline with paperwork attached, and April 2028 as the real Essential one. No legal deadline moved: this is a request for information under Article 48 of the NIS2 law, not a change to it. What is new is the 2028 date.
• A risk analysis can justify aiming lower. Then you owe nobody a catch-up plan, you simply demonstrate the level you chose. That escape hatch is in Article 7 of the royal decree and it is unchanged.

CCB: new communication for NIS2 essential entities → https://ccb.belgium.be/news/new-communication-nis2-essential-entities

Update your SharePoint server now

The line on the supply list that turns out to be for the other class.

Is this you?

• Microsoft fixed it in the July updates. Anyone current was never exposed. The whole window belonged to servers that had not applied a month-old patch, which is the ordinary case, not the unlucky one.
• Affected: SharePoint Server Subscription Edition, 2019, and Enterprise Server 2016. SharePoint Online is not affected.
• The gap between a published write-up and mass attacks is now a day. That is the part worth carrying away, more than the number. "We patch monthly" was a sound policy when that gap was measured in weeks.

Help Net Security: attackers exploit critical SharePoint flaw after PoC goes public → https://www.helpnetsecurity.com/2026/08/13/microsoft-sharepoint-cve-2026-55040-poc-exploit/

We now show which updates failed

A folder with tabs and your name on it, instead of one envelope with everything shaken into it.

If you sync NinjaOne, the patch and antivirus evidence we collect no longer lands as a single unreadable blob. It lands as a folder:

• Failures are sampled first, deliberately. Big fleets overflow the row cap on patch tables. Failed patches rank ahead of pending, pending ahead of merely high-severity, and degraded antivirus endpoints ahead of healthy ones. A fleet with 1,500 clean patches and one failure used to be able to produce a file showing nothing wrong. Evidence that hides the one bad row is worse than none, because it reads like proof.
• This is the whole point of collecting it. Evidence exists to be handed to someone who did not build your systems and does not trust you yet. If they cannot navigate it, you have a backup, not evidence.
• Nothing to switch on. The next sync writes the new shape.

Open your evidence folder → https://easycyberprotection.com/app