A contact list can end up in a business application, a shared mailbox and several working exports. When an incident is announced, knowing where those copies are helps you ask the right questions. A statement published in Belgium this week provides an opportunity to review that organisation, without assuming that your business is affected.
What the Belgian statement says
The AVOCATS.BE statement dated 6 November 2026 follows up on the incident reported on 29 October in its bar management application. It describes contact and identification data, including data relating to people other than lawyers. According to the analysis available on 3 November, no banking or sensitive data had been identified as affected. The scope may still be clarified.
For a small organisation, our suggestion is to use this news as a starting point for reviewing its own files. That review alone cannot establish that unauthorised access has occurred in your organisation.
Start with one actual directory
Choose a regularly used list: an association’s partners, training participants or contacts for a project. Record its reference location, owner and the teams that need it. Then ask staff where they look for an address when they need to contact someone.
We recommend comparing those answers with the tools actually used. An official list may coexist with an old export, a shared folder and an attachment kept for an event. Make an inventory of locations without copying the contact details into a new spreadsheet that would become another copy.
Review access and exports
For each location, ask three questions: who can view it, who can edit it and who can export a copy? Have the person administering the tool verify the answers rather than relying on the folder’s name. Identify former staff accounts and sharing arrangements created for completed assignments.
Then decide with the business owner which copies remain necessary and who should approve archiving or deletion. Avoid an improvised bulk deletion: a file may still support ongoing work or need to be retained for a reason that requires review. The aim is a documented decision, rather than simply emptying a directory.
Prepare a proportionate response
The Cybermalveillance.gouv.fr factsheet recommends carefully reading the affected organisation’s information when a leak is announced and independently verifying the identity of someone contacting you. These prevention tips remain useful; the French administrative procedures described in that factsheet are not applied to Belgium here.
We suggest naming an internal contact and a familiar reporting channel. If an announcement concerns one of your tools, keep the statement, record confirmed facts and ask the application owner what needs to be reviewed. Avoid circulating the affected files in a group chat to organise that review.
A short review, followed by a check
Finish with a concise list: the reference location, access to review, copies to examine and the person responsible for the next check. This gives your team and support provider something concrete to work with.
Would you like to review your access arrangements and practices? Explore our cybersecurity support and contact MYCIO to discuss your environment.