#CyberWeekly

Non-IT Say this to your staff today: nothing about MyMinfin, a tax refund or a new filing date gets a click, however real it looks. Type minfin.fgov.be yourself and log in with itsme or your eID. Then call your accountant about anything due on 31 October.

IT Nothing of yours to update for this one. Add a rule today that flags inbound mail naming MyMinfin, Tax-on-Web or FOD Financiën when the sender is not a fgov.be domain, and tell the office you did.

Is this your problem? Yes, if you file anything with the Belgian tax authority, which is every company in the country. Yes twice if a return of yours is due on 31 October. The attack itself is the ministry's problem. The wave of fake mails that follows every outage like this is yours, and it does not care what sector you are in or whether NIS2 applies to you.

What happened On Wednesday 28 October the Federal Public Service Finance announced it was the target of a cyberattack. As a precaution it took MyMinfin, Tax-on-Web and its other digital services offline. Citizens and companies could temporarily neither view nor file their returns (VRT NWS).

• What they said: no indication of a data leak "at this moment". They are aware the shutdown affects the coming tax deadlines and promise "sufficient extension" for the returns with specific income normally due on 31 October. A new date is to follow (ITdaily).
• What they did not say: who attacked, how, how far they got, or when the services come back. Cause and scale are under investigation.
• By Thursday morning we had seen neither an all-clear nor the new date. Before you act on any message that claims to know, check the ministry's own site.

Why this one is different from last week. Week 43 was a precaution: organisations switched their own websites off before anyone attacked, and MyMinfin stayed up. This week somebody did attack, and the systems that hold every company's tax file went dark three days before a deadline. What follows an outage like this, every time, is a flood of mails that look like the ministry's: "MyMinfin is back online, log in here", "your refund is ready", "new deadline, confirm your details". Expect them from today.

The one thing: by tonight your accountant knows what you both do about 31 October.

Three things to do this week:

1. Non-IT Warn the people who pay the bills. The sentence at the top of this story, said by name to the person who does your VAT return. That person is the target, not the IT team.
2. Non-IT Call your accountant today about anything due on 31 October. Agree who files what, by which route, and what you do if the portal is still dark on Friday. Keep a screenshot of the outage notice with the date on it. That is our advice, not the ministry's; it answers "why did you file late" before anyone asks.
3. Non-IT Write down the three online portals your firm cannot work without, such as the tax office, your bank, a customer's ordering system, the social secretariat. Next to each: what you do for a week when it is dark, and who you call. Ten minutes on paper, and most small firms never do it.

IT The mail rule above, and a look at who in each client firm holds the itsme or eID that files the returns. That person gets the one-line warning by name. How the fake mails look, and what to tell staff, is in our guide on spotting phishing.

Out of office: the ministry hung the sign on Wednesday. The criminals read it too.

Non-IT Two jobs this week, no update needed. Run your company domain through Have I Been Pwned, the free register of leaked logins, and see which staff addresses turn up. Then write a name next to "who answers when the Data Protection Authority, a customer or a journalist calls about our data".

IT Nothing to update. For every client: the domain check at Have I Been Pwned, a password reset for every address that appears, and a second login step on the mailbox of whoever would have to answer the regulator.

What happened On 24 October the Belgian firm Fox&Fish Cyberdefense published a count, picked up by L'Echo: at least 47 Belgian organisations have suffered a hack or a data leak since January. The CCB, the federal cyber agency, confirmed the figure and had counted 40 for the whole of 2025 (Econostrum, relaying L'Echo).

• Who: municipalities, hospitals, travel agencies and private companies. Not the biggest names: firms with a customer file and nobody whose job is security.
• What: names, birth dates, addresses, phone numbers, bank account numbers, and in some cases family photos.
• What it sells for: a few hundred euros per batch, according to the researchers. The file itself is cheap. A caller who knows your bank account and your birthday gets believed, and that is what the buyer pays for. This week's fake tax mails work the same way.

How this differs from last week's number. Week 43's 588 were reports to the CCB of every kind of incident. These 47 are confirmed leaks of personal data, the ones that end with a letter to the Data Protection Authority within 72 hours, and in many cases to every person in the file. Fox&Fish's Mathias Vissers expects AI to push the count up, because it makes the first break-in cheaper.

A leak at a supplier of yours counts too: if your customer data sat in their system, your 72 hours start the moment you hear of it. The incident reporting clock on our site lays out every deadline, and the incident response guide says who tells whom.

Better to know your domain is on a list before a journalist tells you.

New here? Easy Cyber Protection (ECP) is the platform IT partners use to get small and mid-sized firms ready for a CyFun audit under NIS2.

This week we put the first checks outside the login. Four free tools and a downloads page, under Free tools & downloads in the menu. There is no account to create and nobody calls you afterwards.

• Incident reporting clock. Enter when you found out; it shows every reporting deadline to the CCB, to the minute. The NIS2 deadlines (24 hours, 72 hours, one month) and the 72-hour GDPR one from story 2, counted from when you knew.
• NIS2 scope check. Now uses the legal size test, headcount and turnover as the law counts them, so the answer matches what the CCB would say.
• NIS2 fine calculator. What the law allows, for your size and category. A number you can put in front of the board.
• CyFun Basic readiness quiz. Nineteen questions in plain language. The result says how far you are from the Basic level, before anyone opens a spreadsheet.
• Free downloads. The PANIC sheet, one A4 for the wall with six report cards and QR codes for the moment something goes wrong; NIS2 in six steps on one page; and our guide for IT partners. The downloads, unlike the tools, ask for an email address first.

IT Send a client the quiz before a first meeting and use the score as the agenda. The PANIC sheet goes on the wall next to the printer, in the client's language.

Non-IT Start with the clock: pretend you found out at 9 this morning and see what is due by tomorrow. The changelog lists everything else that shipped this week, including two fixes in the app.

Not in IT? Forward this part to your IT partner and ask for a yes on each of the four rows. Everything below is for them.

IT Per product: the flaw, the fix, the deadline and who checks.

• Nextcloud, Collabora Online Built-in CODE Server app
  Flaw: CVE-2026-110447, OS command injection, remote code execution, exploited.
  Fix: 26.4.303, or remove the app and point Nextcloud at a separate Collabora server.
  Do by: now. CISA's deadline was 26 October.
  Who checks: IT on every Nextcloud you run or host.
• Adobe Commerce and Magento Open Source
  Flaw: CVE-2026-48356, unrestricted file upload, CVSS 9.6, on CISA's exploited list since 27 October.
  Fix: the "-2026-jul" release of your line, 2.4.4 up to 2.4.9.
  Do by: this week. CISA says 10 November.
  Who checks: IT or the agency that runs the webshop.
• Linux kernel on web hosts
  Flaw: CVE-2026-46300, chained with the PHP flaws of week 43 to plant a webshell and run commands as root.
  Fix: your distribution's current kernel, then the PHP line again.
  Do by: now. CISA's deadline is 31 October.
  Who checks: IT or the hoster.
• VMware ESXi
  Flaw: CVE-2026-41709, admin operations not written to the log, CVSS 2.7, exploited.
  Fix: ESXi 8.0 ESXi80U3j-25429389; ESXi 9.0 ESXi-9.0.2.0100-25595025; VMware Cloud Foundation 5.x to 5.2.4. No workaround.
  Do by: this week. CISA says 11 November.
  Who checks: IT.

In plain words:

• Nextcloud office app. Who should care: anyone who edits documents inside Nextcloud, often an IT partner's own file share. Ask: "Do we run the built-in CODE app, and is it on 26.4.303?" Technician: the flaw bites when the bundled CODE server is not running, which is exactly the state of a half-set-up install. Deadline was Monday 26 October; treat it as overdue.
• Adobe Commerce. Who should care: anyone with a Magento webshop. Ask: "Is our shop on the July 2026 security release?" A stranger can upload a file of their choosing and run it. Adobe said in July no attacks were known; CISA added it to the exploited list on Monday. Technician: the fix shipped on 14 July; a shop still without it has missed a quarter of updates.
• Linux kernel. Who should care: anyone whose web host did the PHP update last week and nothing else. The kernel flaw turns a PHP break-in into full control of the server. Technician: CISA's notes list the stable commits; check your distribution's own advisory for the package. Reboot counts.
• VMware ESXi. Who should care: anyone whose servers run as virtual machines on VMware, which is most IT partners. Ask: "Is ESXi on 8.0 U3j or 9.0.2?" The flaw itself is small: admin actions went unlogged. CISA says it is being exploited, and a log gap is worth most to someone already inside. Technician: a 2.7 on the exploited list means someone uses it, not that the bug is big.

PHP, one week on. CISA put the two PHP flaws on its exploited list on 26 October with a deadline of 29 October, today. If your hoster has not answered week 43's one-line question yet, that is your answer.

When all four rows say yes, take the sign off the door.