Belgian notary listed on a leak site

Every deed you ever signed is in somebody else's cupboard.

On 27 August a Belgian notary practice was added to a ransomware gang's public victim list.

• We are not printing the practice's name, and that is a change from last week. In week 35 we named all six Belgian organisations on the August list, because a public tracker already did and because they were a university, the European standards bodies and two national chains. A single notary practice is one or two people whose clients read this newsletter. Nothing here is confirmed by anyone except the criminals, so the name stays out and the public tracker stays linked.
• Listed is not the same as breached, and neither is the same as published. A leak site is a pressure tactic: the gang posts a name to start a clock. Sometimes files follow. Sometimes the company had good backups and nothing follows at all.
• This was the only new Belgian entry since 16 August. The six we reported in week 35 all landed between 1 and 16 August and nothing has been added since, apart from this one. Quiet weeks are real. They are not proof of anything.

ransomware.live: Belgian victims tracked from leak sites → https://www.ransomware.live/country/BE

Ask a question they can answer

You have just read two questions to send your notary, and I want to be honest about why they are so short.

It is because I spent this year asking people questions they could not possibly answer, and I only noticed on Wednesday. To quote a price for this platform we used to ask a company how many entities it had.

Ransom crews are hitting AI tools

A document goes out at night and nobody countersigns it.

Is this you? Only if somebody at your company has installed something in the last year to connect your business to an AI model.

• The AI one is the one to look for. In LiteLLM, a popular open-source tool that sits between a company and the AI models it uses, an attacker could make up an authorisation header and walk straight in. Fixed in version 1.84.0. Ask whoever set yours up which version it runs.
• Qilin has been linked to it. That is the same crew that listed a Belgian university, a travel agency and a furniture chain in August. Reporting says they used chained flaws in that AI tooling to earn money from other people's computers, which in practice means your cloud bill. Linked, not confirmed, and we will say so if that changes.
• Two more on the list are ordinary business kit. SonicWall SMA 1000 remote-access appliances, scored a maximum 10.0, where an attacker with no login at all can get in. And JFrog Artifactory, where the default settings let a stranger become an administrator. Neither is exotic. Both are the sort of thing a mid-sized Belgian company has because a supplier installed it years ago.

CISA: seven known exploited vulnerabilities added, 2 September 2026 → https://www.cisa.gov/news-events/alerts/2026/09/02/cisa-adds-seven-known-exploited-vulnerabilities-catalog

Five auditors, none for Essential

Five names on a list, and the one level that matters is still blank.

Is this you? Only if somebody has told you that you need a CyFun certificate, or you have been asked for one by a customer.

• The newcomer only covers the old version. DNV is authorised for CyFun 2023, not CyFun 2025. If you want to be assessed against the current version of the framework, you are still choosing between the same four names you had last month.
• The number that matters has not moved at all: it is still zero. Nobody is authorised to certify CyFun at Essential level. All five entries on the list stop at Important. If you are an essential entity, the certificate you owe by April 2027 cannot be bought today at any price, from anyone.
• That gap is why the CCB wrote to essential entities on 11 August. The letter is about remediation plans rather than certificates, which is the regulator quietly acknowledging that the thing it requires does not exist yet. Essential entities currently reach presumption of conformity through ISO 27001 instead, where auditors are actually available.
• One date for the diary, and it is close. Brand Compliance Belgie's CyFun authorisation runs out on 8 November 2026. If you are planning an assessment on the other side of that date, confirm the renewal before you book, not after.

CCB: bodies authorised for NIS2-related conformity assessment, 25 August 2026 (PDF) → https://cyfun.eu/sites/default/files/2026-08/Overview_CABs_authorised_for_NIS2_related_CA_2026-08-25.pdf

We now publish what we charge

We took our own price list out of the back room.

You can now read our prices on the website without asking anybody.

• The size bands are the ones the law already put you in. They are the same thresholds that decide whether NIS2 applies to you at all, so you are not learning a new vocabulary to read a price.
• One licence covers every level, and moving up costs nothing. Small, Basic, Important and Essential are all included. If a customer's questionnaire pushes you from one level to the next in March, your bill does not move. Several tools in this market price each framework separately.
• Paying less often costs less. Quarterly takes 6 percent off, six-monthly 8 percent, a year paid up front 12 percent. Same rule for every size.

See what you would pay → https://easycyberprotection.com/learn/compare/nis2-compliance-software-pricing/