Unpacking compliance, security and AI.
Our DPOs and CISOs regularly share their take on regulatory and technical news here: new CNPD guidelines, notable sanctions, incident lessons learned, evolutions on the AI Act, NIS 2 and DORA. To go beyond the press release.
109 articles found · #cybersecurite
Dutch AP and Council for the Judiciary: data leak via Ivanti EPMM
On 9 February 2026, the Dutch data authority (AP) and the Council for the Judiciary confirmed a leak via Ivanti EPMM flaws exposing professional contact data. How to turn MDM into evidence of control under GDPR Art. 32 and NIS 2.
South Staffordshire Water: £963k fine for detection failures
The ICO fined South Staffordshire Water £963,900 for ~5% monitoring coverage and near-absent detection. Here’s why a 24/7 operated EDR/XDR stack is now essential.
EvilTokens/ARToken: device-code attacks on Microsoft 365 — move to FIDO2
ARToken abuses the OAuth device-code flow to compromise Microsoft 365 accounts despite MFA. Move to FIDO2/WebAuthn and tailored access policies to reduce risk and demonstrate GDPR Article 32 compliance.
CSSF 25/903: Support PSF — the inventory/CMDB as key evidence
CSSF 25/903 strengthens 24/850 and requires structured evidence on support PSF ICT organization. An automated inventory/CMDB becomes central to trace assets, dependencies and controls, and to meet NIS 2 obligations.
European Commission: Europa.eu breach — how a CSPM prevents the next one
On March 27, 2026, the European Commission confirmed data exfiltration from its cloud hosting Europa.eu. Here’s how a CSPM evidences compliance (GDPR Art. 32, CSSF 22/806) and prevents a repeat.
Ernst & Young: support ticket data leak — DLP for GDPR Art. 32 and cross‑border transfers
In July 2026, EY confirmed fraudulent access to a third‑party ticketing tool with tax documents downloaded. Here is a practical DLP to curb exfiltration and evidence GDPR compliance (Art. 32 and 44‑49).
LAUNDRY BEAR/NCSC: 'beehive' targets Zimbra — messaging security (NIS 2)
NCSC and partners expose “LAUNDRY BEAR”: a zero‑click campaign against Zimbra. This is the email stack (SEG + DMARC/SPF/DKIM) and NIS 2 actions to reduce risk and notify properly.
CSSF 26/906: strengthened governance and risk — an ISO 27001 ISMS to evidence NIS 2
CSSF 26/906 tightens governance and risk for payment/e-money institutions, with compliance due by 30 June 2026. A certified ISO 27001 ISMS operationalizes these requirements and NIS 2 Article 21.
Pope Francis: Data Breach Exposes 700,000 Users of Official Prayer App
The Vatican's official prayer app suffered a major data breach, exposing personal information of over 700,000 users. A security flaw in the code allowed unauthorized access to sensitive data, highlighting risks associated with poorly secured mobile applications.
CSSF 26/904: stronger ICT evidence — inventory/CMDB becomes essential
CSSF Circular 26/904 tightens investment firms’ self‑assessment by requiring concrete evidence on ICT organization. An automated inventory and a relational CMDB are the most reliable way to demonstrate effective control.
CNIL fines Free/Free Mobile €42M and why to move to FIDO2 MFA
CNIL fined Free and Free Mobile €42M for insufficient security, including weak VPN authentication. Deploying FIDO2/WebAuthn MFA concretely meets GDPR Article 32 and reduces risk.
CSSF 26/914: AMLA supervision — the ICT inventory becomes vital
CSSF 26/914 identifies entities eligible for AMLA’s direct supervision. Governance and traceability tighten: a reliable, continuous inventory/CMDB is now essential to evidence NIS 2/ISO 27001 controls.