single: text module
To the European Cybersecurity Month (ECSM) , the SIBB uses real-life cases to illustrate what SMEs need to keep in mind after a cyberattack.
The CEO wearily opens his laptop and is startled. Instead of the usual startup screen, a ransom note appears. The company’s key customer, corporate, and applicant data has been encrypted. The attackers are threatening to publish the sensitive data.
The phones at the company are ringing nonstop. Worried employees can’t work, and customers are waiting impatiently for answers. No one knows whether data has actually been compromised. Decisions must be made immediately: Which systems need to be taken offline? Which records must not be deleted? Do authorities, insurers, or customers need to be notified?
The attack marks the beginning of a second crisis
This anonymized case from legal practice shows that a cyberattack is not just a technical emergency. While the IT department fights to keep the systems running, a second crisis begins for company management—one involving legal deadlines, liability issues, and intense pressure to make decisions.
In conjunction with the ECSM in October, SIBB e. V. is therefore focusing on the legal aspects of cyberattacks. It’s an uncomfortable topic that many companies would rather put off. In an emergency, however, there simply isn’t time for that.
“The biggest knowledge gap often lies not in prevention, but in the question: What specific steps do I need to take in the first 72 hours after an incident?” says Daniel Schätzle, an attorney specializing in IT security law at HÄRTING Rechtsanwälte. “The first 72 hours are not a time for improvised, ad-hoc decisions. Companies need a predefined procedure with clear lines of responsibility.”
Small and medium-sized businesses, in particular, face an enormous challenge: They must comply with increasingly stringent regulatory requirements, yet often lack both an in-house security team and specialized legal resources.
If personal data is involved, a report to the data protection supervisory authority may be required. In general, there is a 72-hour deadline for this, after the breach has come to light. At that point, it is often still unclear exactly what happened. This makes it all the more important to document findings, risk assessments, and decisions from the very beginning.
A doctored invoice—and the money is gone
A second real-world case begins more unobtrusively. AThrough a method that remains unclear , attackers gain access to a company’s email accounts and monitor the correspondence. When a large invoice is sent out, they alter the bank account information. The money ends up in the perpetrators’ hands. The fraud isn’t discovered until the actual recipient inquires about the payment.
In the aftermath, the focus isn't just on the technical cause: Were logins protected by multi-factor authentication? Did new bank account details have to be confirmed via a second communication channel? And were there procedures in place for how IT service providers would provide support in an emergency?
Acting too hastily can also exacerbate the damage. If systems are immediately deleted or reinstalled, important evidence needed for investigations, insurance claims, and legal proceedings may be lost. “A company doesn’t have to know everything in the first few hours,” explains Schätzle. “But it must be able to demonstrate that it acted in a structured, risk-based, and transparent manner.”
“You should regularly run through emergency scenarios with employees and service providers,” adds Andrea Hornung, Director of Cybersecurity & Innovation at SIBB e. V. “It’s only during a drill that you see where the problems lie: a missing phone number, an unclear approval process, a plan that’s stored only on the company server. These gaps can then be addressed calmly, rather than under pressure after an attack. In crisis mode, only what has been practiced beforehand will work.”
SIBB supports companies in collaboration with its network and as a partner of the EDIH pro_digital , among other things, in assessing security risks and strengthening their digital resilience.
Help in the Event of a Cyber Emergency
- emergency-assistance.transferstelle-cybersecurity.de/
Free digital initial assessment with general recommendations for action, as well as a search for experts in incident response, data recovery, data protection, and crisis communication. Subsequent services may be subject to a fee. - digitalagentur.berlin
Free and, upon request, anonymous initial assistance for Berlin-based companies at 0800 360 30 60, Monday through Friday from 9 a.m. to 5 p.m. If needed, the service will connect you with specialized IT security firms. - www.bsi.bund.de
Organizational and technical checklists, ransomware first aid, an IT emergency guide, information on reporting requirements, and qualified service providers.
SIBB members who work in cybersecurity
- O&O Software: https://www.oo-software.com
- Office Company: https://www.office-company.de
- M&H IT Security (Berlin): https://mh-it-security.de
- Pÿur Business: https://www.pyur.com/en/business/solutions/it-security.html
- SHD System-Haus-Dresden: https://www.shd-online.de
- Xopero: https://www.xopero.com
- CCVossel: https://www.ccvossel.de
- Quirso: https://www.quirso.de
- PID1: https://www.pid1.tech
- Digital Trust Analytics: https://www.digitaltrust.de
- e*message: https://www.emessage.de
- Kroker Legal: https://kroker.legal
- Härting: https://haerting.de
- Derdack: https://www.derdack.com/
- NordSecurity: https://nordsecurity.com
- nenna.ai: https://www.nenna.ai
Networking, Managed IT, and Secure Architecture: Pÿur Business, Office Company, SHD, PID1
Detection, Response, and Penetration Testing: CCVossel, Quirso
Consulting, Compliance, and Training: M&H IT Security, Digital Trust Analytics, CCVossel, Office Company
Law and Data Protection (including AI data protection): Härting, Kroker Legal, nenna.ai
Data Backup and Recovery: Xopero, O&O Software
Privacy and Access Tools: NordSecurity
Related Areas (Alerting, Secure Development): e*message, Derdack.
If you would like detailed information about the cases mentioned, please feel free to send an email to clemens@sibb.de
single: text module
To the European Cybersecurity Month (ECSM) , the SIBB uses real-life cases to illustrate what SMEs need to keep in mind after a cyberattack.
The CEO wearily opens his laptop and is startled. Instead of the usual startup screen, a ransom note appears. The company’s key customer, corporate, and applicant data has been encrypted. The attackers are threatening to publish the sensitive data.
The phones at the company are ringing nonstop. Worried employees can’t work, and customers are waiting impatiently for answers. No one knows whether data has actually been compromised. Decisions must be made immediately: Which systems need to be taken offline? Which records must not be deleted? Do authorities, insurers, or customers need to be notified?
The attack marks the beginning of a second crisis
This anonymized case from legal practice shows that a cyberattack is not just a technical emergency. While the IT department fights to keep the systems running, a second crisis begins for company management—one involving legal deadlines, liability issues, and intense pressure to make decisions.
In conjunction with the ECSM in October, SIBB e. V. is therefore focusing on the legal aspects of cyberattacks. It’s an uncomfortable topic that many companies would rather put off. In an emergency, however, there simply isn’t time for that.
“The biggest knowledge gap often lies not in prevention, but in the question: What specific steps do I need to take in the first 72 hours after an incident?” says Daniel Schätzle, an attorney specializing in IT security law at HÄRTING Rechtsanwälte. “The first 72 hours are not a time for improvised, ad-hoc decisions. Companies need a predefined procedure with clear lines of responsibility.”
Small and medium-sized businesses, in particular, face an enormous challenge: They must comply with increasingly stringent regulatory requirements, yet often lack both an in-house security team and specialized legal resources.
If personal data is involved, a report to the data protection supervisory authority may be required. In general, there is a 72-hour deadline for this, after the breach has come to light. At that point, it is often still unclear exactly what happened. This makes it all the more important to document findings, risk assessments, and decisions from the very beginning.
A doctored invoice—and the money is gone
A second real-world case begins more unobtrusively. AThrough a method that remains unclear , attackers gain access to a company’s email accounts and monitor the correspondence. When a large invoice is sent out, they alter the bank account information. The money ends up in the perpetrators’ hands. The fraud isn’t discovered until the actual recipient inquires about the payment.
In the aftermath, the focus isn't just on the technical cause: Were logins protected by multi-factor authentication? Did new bank account details have to be confirmed via a second communication channel? And were there procedures in place for how IT service providers would provide support in an emergency?
Acting too hastily can also exacerbate the damage. If systems are immediately deleted or reinstalled, important evidence needed for investigations, insurance claims, and legal proceedings may be lost. “A company doesn’t have to know everything in the first few hours,” explains Schätzle. “But it must be able to demonstrate that it acted in a structured, risk-based, and transparent manner.”
“You should regularly run through emergency scenarios with employees and service providers,” adds Andrea Hornung, Director of Cybersecurity & Innovation at SIBB e. V. “It’s only during a drill that you see where the problems lie: a missing phone number, an unclear approval process, a plan that’s stored only on the company server. These gaps can then be addressed calmly, rather than under pressure after an attack. In crisis mode, only what has been practiced beforehand will work.”
SIBB supports companies in collaboration with its network and as a partner of the EDIH pro_digital , among other things, in assessing security risks and strengthening their digital resilience.
Help in the Event of a Cyber Emergency
- emergency-assistance.transferstelle-cybersecurity.de/
Free digital initial assessment with general recommendations for action, as well as a search for experts in incident response, data recovery, data protection, and crisis communication. Subsequent services may be subject to a fee. - digitalagentur.berlin
Free and, upon request, anonymous initial assistance for Berlin-based companies at 0800 360 30 60, Monday through Friday from 9 a.m. to 5 p.m. If needed, the service will connect you with specialized IT security firms. - www.bsi.bund.de
Organizational and technical checklists, ransomware first aid, an IT emergency guide, information on reporting requirements, and qualified service providers.
SIBB members who work in cybersecurity
- O&O Software: https://www.oo-software.com
- Office Company: https://www.office-company.de
- M&H IT Security (Berlin): https://mh-it-security.de
- Pÿur Business: https://www.pyur.com/en/business/solutions/it-security.html
- SHD System-Haus-Dresden: https://www.shd-online.de
- Xopero: https://www.xopero.com
- CCVossel: https://www.ccvossel.de
- Quirso: https://www.quirso.de
- PID1: https://www.pid1.tech
- Digital Trust Analytics: https://www.digitaltrust.de
- e*message: https://www.emessage.de
- Kroker Legal: https://kroker.legal
- Härting: https://haerting.de
- Derdack: https://www.derdack.com/
- NordSecurity: https://nordsecurity.com
- nenna.ai: https://www.nenna.ai
Networking, Managed IT, and Secure Architecture: Pÿur Business, Office Company, SHD, PID1
Detection, Response, and Penetration Testing: CCVossel, Quirso
Consulting, Compliance, and Training: M&H IT Security, Digital Trust Analytics, CCVossel, Office Company
Law and Data Protection (including AI data protection): Härting, Kroker Legal, nenna.ai
Data Backup and Recovery: Xopero, O&O Software
Privacy and Access Tools: NordSecurity
Related Areas (Alerting, Secure Development): e*message, Derdack.
If you would like detailed information about the cases mentioned, please feel free to send an email to clemens@sibb.de