Simian Drukland data breach: what we know and what customers should do

In August 2026, Simian — the Dutch company behind the printing sites Drukland, Reclameland and Flyerzone — confirmed a security incident. Its own customer notice said outsiders may have reached the customer file and taken usernames (email addresses) and scrambled, or hashed, passwords. Simian told the Dutch data watchdog and the police, blocked affected accounts, reset every user’s password, tightened access, and hired an outside security firm.

Later statements to the press added that the break-in happened at an external supplier, not on Simian’s own systems, and that all three brands were involved. A small number of customers also had credit-card details taken; those people were notified individually by phone and email. Simian has not said how many customers were affected in total. Its own site says it serves 500,000 customers in the Netherlands and Belgium. News of the disclosure appeared from around 11 August 2026.

The number in the headlines is not a list of victims

Most coverage leads with “more than 500,000 customers.” That number is how Simian describes its customer base. It is not a figure the company has given for how many records were opened or stolen. The official notice does not give a count, name the supplier, or mention cards. We still do not know the real number.

The other calming line is that passwords were only scrambled, that this sat with a supplier, and that only a small group had card details taken. Those things can be true and still leave you exposed. A scrambled password can be cracked if it was short, common, or one you also used on email, a webshop, or social media. And Simian reset every user’s password. That is what a company does when it cannot rule people out. The only customers who got a personal call were the ones whose cards were involved. For the email-and-password part, no all-clear is coming.

If your login was in that file, what someone actually holds is not a print job. It is a real customer email, a password that may still open other accounts, and a reason to write to you as if they are Drukland, Reclameland or Flyerzone. The useful reading is not “it was hashed, so relax.” It is that a convincing fake invoice, password-reset page, or “confirm your order” message is more likely than a stranger at your door.

What to actually expect

• You may already have had your password reset by the company. That reset is not proof you were in the stolen file, and it is not proof you were left out.
• Expect emails that look like they come from Drukland, Reclameland or Flyerzone — about the incident, an unpaid order, or a new login. Some may be real; some will be traps. Do not click links in those messages. Open a browser and type the site address yourself.
• If your card was in the small group, Simian says it already called and emailed you. If nobody contacted you that way, your card was probably not in that set. If you ever saved a card on those sites, still watch your statements for a few months.
• If that password was one you used anywhere else, those other accounts are the near-term problem — not the print order itself.

What you can and cannot fix

If your email address and scrambled password were taken, that copy cannot be pulled back. The same is true for the credit-card numbers belonging to the small group that was notified. No company or removal service can un-steal them. Simian has not confirmed that names, home addresses, phone numbers or other details were in the file; those should not be assumed either way.

Nobody can reliably check whether you were in this incident. That kind of list is almost never something an online scan can see, and a clean result would not mean you were safe.

• If you reused that password anywhere, change those logins now. Start with the inbox attached to the account, then banking, shops and social media. Turn on a second check at login — a code on your phone — on email first, because that inbox is how every other reset works.
• If you ever stored a card with these brands, watch the statement. If you want to be sure, ask your bank to replace the card. The notified group should treat that as urgent; everyone else can treat it as a precaution.
• Treat unexpected mail about this incident as untrusted. Type the official address yourself rather than using a link, and do not give a password or card number to anyone who contacts you first.
• This leak is thinner than a name-and-address dump, so wiping people-search listings is not the main lever. It still helps in one way: a bare email becomes more useful to a scammer when it can be matched to a public listing that adds a phone number, relatives or a workplace. Those listings, unlike the stolen file, can actually be taken down.