Belgian travel agency & university named on ransomware sites

Term starts on Tuesday. Somebody has already been reading out a register.

Between 1 and 16 August, six Belgian organisations were added to ransomware leak sites. Since 16 August, none.

• Only one has confirmed anything, and it is the one you already read about. WEBA, whose reopening we covered last week, says customer names, addresses, phone numbers and order history were taken. The other five have said nothing. A leak-site entry is a criminal's claim, not a company's statement, and listed is not breached. We name them because a public tracker already does.
• No law would have saved any of them. Five of the six fall outside every cyber regulation Belgium has. Rules follow the damage; they do not prevent it.
• Sixteen days, then a fortnight of nothing. Do not read that as safety. Postings run weeks behind the break-in, and August is when the people who would notice are on the coast.

ransomware.live: Belgian victims tracked from leak sites → https://www.ransomware.live/country/BE

We put the lock on the wrong door

You have just read about six organisations that had no more reason to expect it than you do.

Here is a confession to go with it. All year I have told people they were missing a second lock on the front door, and I flag it wherever I look. Then somebody asked whether this platform had one. It did not.

Manufacturers: report a hack in 24 hours

A new subject on the timetable, and the first test is in sixteen days.

From 11 September the EU's Cyber Resilience Act starts asking manufacturers to report.

• It covers what you have already sold. A controller you shipped in 2023, still running in a customer's plant, is inside it.
• It is a separate net from NIS2, and it catches smaller companies. A fifteen-person firm building connected equipment in Flanders is very unlikely to be a NIS2 entity and is squarely inside this. The two share no scope, deadline or reporting route.
• The reporting platform is scheduled, not proven. ENISA's portal is meant to be running on 11 September. Assume your first report may have to go the slow way.

European Commission: Cyber Resilience Act reporting obligations → https://digital-strategy.ec.europa.eu/en/policies/cra-reporting

Update your Zimbra server now

Homework set in July. Eight thousand still have not handed it in.

Is this you? If your email is Microsoft 365 or Google Workspace, skip this one.

• It only fires where SNMP notifications are switched on, which is why some Zimbra servers were taken in July and others never noticed. The flaw is CVE-2026-73570, a command injection in Zimbra's SNMP monitoring component. Neither the customer nor most partners will know which they are without looking.
• Updating closes the door. It does not put anyone out. A server left reachable for five weeks needs its logs read, not just its version checked, and "we patched it" does not answer that. CERT Polska published what to look for: the Zimbra service restarting when nobody restarted it, and files created by the zimbra user in the jetty webapps folders or in /tmp in the last thirty days.

BleepingComputer: hackers breached over 270 Zimbra servers → https://www.bleepingcomputer.com/news/security/hackers-breached-over-270-zimbra-servers-in-ongoing-attacks/

We now offer two-step login

The lock on the locker, fitted at last.

You can now switch on two-step sign-in.

• Where the code is asked for matters more than that we added it. It comes at the moment a session starts, not on the login page, because most people here never load the login page. Every path that begins a session now asks, including a partner signing in to a client's account, which is the one an auditor asks about first.
• Changing your second factor signs out everything else, on every device. That is the point of it.
• Switching between organisations does not ask again. You are already signed in, and prompting on every switch is how a good feature gets turned off in a fortnight.

Switch on two-step sign-in → https://easycyberprotection.com/app