Home › IT Security › Cyber Attack and Ransomware
After a cyber attack, technical recovery, reporting deadlines and liability questions all run at the same time. The first 72 hours often decide whether fines, damages claims and disputes with the insurer follow. We support companies from the first call, together with forensic experts and the IT team.
Incident in progress? Call us directly on +49 511 35 73 56-0. If possible, do not contact us from an email account that may be compromised.
Immediate steps after a cyber attack
- Disconnect affected systems from the network, but do not switch them off or rebuild them. Memory and log data are important evidence.
- Set up a crisis team: management, IT, data protection officer, communications, legal. Record decisions with the time.
- Inform your cyber insurer immediately and follow its requirements on service providers and hotline.
- Instruct IT forensic experts, ideally through the law firm, to better protect the confidentiality of the investigation.
- Reset credentials, especially administrator and cloud accounts; check backups for integrity before restoring them.
- Determine the reporting deadlines and document the time of awareness.
- Consider a criminal complaint with the cybercrime contact point (ZAC) of the state criminal police office.
- Do not contact the attackers or promise payment before the legal position has been checked.
Reporting duties after a cyber attack: deadlines
| Legal basis | Recipient | Deadline |
|---|---|---|
| Art. 33 GDPR (data breach) | Data protection authority | 72 hours from awareness; where the risk is high, also notify data subjects (Art. 34) |
| Section 32 BSIG (NIS2) | BSI | 24-hour initial report, 72-hour report, final report after one month |
| DORA (financial sector) | BaFin | 4 hours after classification, no later than 24 hours after awareness; 72 hours; one month |
| Art. 14 CRA (manufacturers) | ENISA reporting platform / CSIRT | 24 hours, 72 hours, final report |
| Insurance contract | Cyber insurer | without delay, according to the policy terms |
The notifications should be aligned. Contradictory statements to authorities, insurer and customers are hard to explain later. Initial reports may be incomplete and supplemented.
Paying a ransom: the legal position
Paying a ransom is not expressly prohibited in Germany, but it is not legally straightforward. It is debated whether payment to an organised group may amount to supporting a criminal organisation (Section 129 StGB); in a genuine emergency, for example where lives or the existence of the company are at stake, justification or excuse may apply. The courts have not settled the question.
Sanctions law draws clearer lines: if the group or a recipient is on an EU sanctions list, payment is prohibited and a criminal offence under the Foreign Trade and Payments Act. For companies with a US connection, US sanctions apply as well. For management, the decision is also a matter of directors‘ duties: it must be documented, based on the available information and taken after weighing the alternatives. Whether the insurer pays depends on the policy.
Communication, evidence and recourse
Communicate with customers and business partners early but carefully. Statements such as „no data has been exfiltrated“ should only be made once the forensics support them. Supply contracts may contain information duties; for supply failures, check whether force majeure can be relied on. Listed companies must consider an ad hoc disclosure under Art. 17 MAR.
Forensic reports serve investigation, regulatory notification and later litigation at the same time. Define their scope and addressees in advance and secure evidence so that it is admissible in court, for example with hash values and a documented chain of custody. Many attacks exploit weaknesses at service providers or missing updates. Whether recourse is possible depends on the contract: service description, SLA, agreed security measures, liability caps. We also act for service providers facing claims after an incident.
Management liability after a cyber attack
After an incident, shareholders, supervisory boards or insolvency administrators examine whether management took adequate precautions. The standard is Section 43 of the Limited Liability Companies Act (GmbHG) and Section 93 of the Stock Corporation Act (AktG), and for NIS2 entities also Section 38 BSIG. What counts is whether risks were identified, measures adopted and their implementation monitored.
Frequently asked questions
When does the GDPR 72-hour deadline start?
When you become aware of the personal data breach, i.e. once there is reasonable certainty that personal data is affected. A short review phase is permissible; waiting until the forensics are complete is not.
Do we have to report the attack to the police?
There is no general obligation. A complaint can still be useful, including for the insurer. Law enforcement has experience with ransomware cases.
May we buy back data from the dark web?
We generally advise against it. The same legal concerns apply as with ransom payments, and deletion by the attackers cannot be verified.
Related topics
- IT security law
- Reporting a data breach
- DORA (in German)
- Cybercrime (in German)
- IT project disputes
Contact us
Has your company been hit by a cyber attack and do you need to deal with deadlines, communication and liability? Call us on +49 511 35 73 56-0 or email info@itrechtler.de.