Your systems are encrypted, data has been exfiltrated, or you have received a ransom note? Here you will find the first steps and a checklist that calculates your statutory notification deadlines from your answers. You can then send your answers directly to our team.
Affected as a private individual, for example by a hacked social media account? JUNLOCK (in German) is the right point of contact.
These steps apply to almost every ransomware incident. They preserve evidence and lay the groundwork for all later decisions.
Unplug the network cable and disable Wi-Fi. Do not shut the devices down: the working memory contains traces that matter for the forensic analysis. This is also what the Federal Office for Information Security (BSI) recommends.
Assume that the attackers are reading your emails and chats. Coordinate by phone or via personal devices. Treat all credentials on affected systems as compromised.
Do not make contact and do not make any payment before the legal questions have been resolved. These concern sanctions law and criminal law. In addition, your cyber insurer usually makes payments subject to its consent.
Under § 30(1) VVG (German Insurance Contract Act), you must report the insured event without undue delay. Many policy terms require notification via a claims hotline and coordination before you engage service providers.
Record, with timestamps, who noticed and initiated what and when. Preserve ransom notes and screenshots. Do not delete anything and do not rebuild any systems before a forensic image has been taken.
Statutory deadlines start running from the moment you become aware of the incident, some of them expire after 24 hours. The intake below determines which ones apply to you. The deadlines run hour by hour, including over weekends and public holidays.
Check whether clean offline backups exist and keep them disconnected from the network. Restore backups only once it is clear how the attackers got in. Otherwise you risk being encrypted again.
From your answers we immediately generate your personal checklist with the calculated notification deadlines. At the end you decide whether to send your answers to us or to use the checklist only.
We advise on the legal questions of the incident. We do not provide IT forensic analysis, system recovery, or technical hardening; for these you engage IT specialists separately. We work together with those providers so that the technical findings and the legal steps fit together.
Review and drafting of notifications under Art. 33 GDPR, § 32 BSIG, and Art. 14 CRA. We align the notifications with one another so that they do not contradict each other.
Reporting the insured event, complying with policy obligations, and clarifying cost coverage for forensics and recovery.
Legal assessment of a payment under sanctions and criminal law. The decision remains yours; we provide a sound basis for it.
Communication under Art. 34 GDPR and with customers, employees, and contractual partners, aligned with your contractual obligations.
Filing a criminal complaint, working with the police’s Central Cybercrime Contact Point (ZAC), and obtaining access to the investigation file for your further claims.
Defending against damages claims under Art. 82 GDPR, claims against service providers, and reviewing management’s responsibility.
During the incident you are supported by lawyers who bring together IT security law, data protection, and IT contract law.
