Unpacking compliance, security and AI.
Our DPOs and CISOs regularly share their take on regulatory and technical news here: new CNPD guidelines, notable sanctions, incident lessons learned, evolutions on the AI Act, NIS 2 and DORA. To go beyond the press release.
31 articles found · #nis-2 · Veille Luxgap
NIS 2 Luxembourg: ILR releases incident guide via SERIMA
The ILR, with HCPN/ANSSI-GOVCERT.LU, CIRCL and CSSF, releases rulebooks to handle NIS 2 incidents and meet the 24h/72h/1-month milestones via SERIMA.
40 medical practices hit: cyberattack at an IT provider
On 22 August 2026, a cyberattack crippled the cloud infrastructure of BMS Engineering in Luxembourg. The company confirmed 40 practices affected, no confirmed leak, while one practice reported patient data loss.
CNIL fines a hospital: €500,000 and security requirements
The CNIL fines the Hôpital privé de la Loire €500,000 after a large-scale EHR breach. A reminder of security (MFA, access rights, detection) and data subject notification requirements, with direct implications in Luxembourg.
MAG: 8.7M customers exposed — third‑party risk hits airports
Manchester Airports Group confirms unauthorized access to parking, lounge, Fast Track and Wi‑Fi data, affecting around 8.7M customers. The case highlights third‑party risk and GDPR/NIS 2 notification duties.
MyDr: 19M health records exposed — third‑party risk hits Europe
Polish health software vendor MyDr suffered a breach disclosed August 12–13, 2026: nearly 19M people and over 12,000 facilities may be affected. Poland’s PM suggested extortion as the motive.
WEBA (BE) hit by Qilin: ransomware, customer data accessed, 48 h recovery
On August 10, 2026, Belgian retailer WEBA was hit by a ransomware attack. Customer data was accessed; operations resumed on August 12. Qilin claimed responsibility on August 16; WEBA says no ransom was paid.
15 August 2026: the Dutch Cybersecurity Act (NIS 2 NL) has entered into force
As of 15 August 2026, the Dutch NIS 2 law (Cyberbeveiligingswet) applies. For groups in Luxembourg with activities or providers in the Netherlands, obligations now apply on both sides of the border.
DGFiP: 600,000 tax records for sale — warning on stealth exfiltration
On 14 August 2026, France’s Finance Ministry confirmed a DGFiP breach with over 600,000 tax records exported. A stealth exfiltration via a spoofed VPN, fueling targeted fraud risks.
PNLD: 135,000 police and partner contacts published on the dark web
The UK’s Police National Legal Database (PNLD) confirmed 1.9 GB of data was posted online: 114,000 PNLD subscribers and 21,000 “Ask the Police” users. The attack, claimed by ExfilSquad, was detected on July 26, 2026.
Liechtenstein: UBO register hacked (31,000 individuals affected)
Liechtenstein confirms data exfiltration from its UBO register (VwbP), affecting around 31,000 individuals. A stark reminder: these registers hold highly sensitive data that must be protected as critical assets.
Coca‑Cola/Fairlife: ransomware, production halt and data theft
Coca‑Cola confirms data theft following a ransomware attack against Fairlife. U.S. production was suspended mid‑July; the Anubis group claims up to 1 TB of data.
Secureholiday (Ctoutvert): 41,577 Dutch campers affected
Ctoutvert (Secureholiday) confirms a breach affecting 41,577 Dutch campers. No IBANs or cards leaked, but emails, phone numbers and stay dates exposed and used for targeted fraud.