When every hour counts: cyberattack, compromised email account, or suspicious access? We provide immediate support with data protection assessments, GDPR reporting, and communication with authorities and affected parties.
We support you in taking the right measures quickly, preventing major damage, maintaining your customers’ trust, and avoiding fines.
Hacking and phishing attacks are now among the most common security incidents in companies. Often, a compromised email or a single wrong click is enough to give unauthorized third parties access to sensitive data.
In this situation, companies are under enormous pressure:
In this situation, it is important to seek quick and experienced advice.
(Cooperation between forensic experts and IT service providers)
A data protection incident occurs when personal data is unintentionally or unauthorized disclosed, altered, lost, or made accessible. This includes, for example, hacked email accounts, compromised passwords, accidentally sent files, or technical malfunctions that could result in data loss.
A report is required if the incident is likely to pose a risk to the rights and freedoms of affected individuals. This is the case, for example, if sensitive data is involved, a possible data leak cannot be ruled out, or attackers gained access to systems. Important: The report must be made immediately, within 72 hours at the latest.
Affected individuals must be informed if there is a high risk to their rights and freedoms. This is the case, for example, if attackers have gained access to personal customer data or particularly sensitive information. The information must clearly state which data is affected, what risks exist, and what protective measures are recommended.
Unauthorized access to data by a hacker or as part of a phishing attack typically also is a criminal offense. Even though the perpetrators are often located abroad and police investigations usually remain inconclusive, we recommend filing a criminal complaint in addition to reporting the incident under data protection law. This is often necessary because most cyber and liability insurance policies require a report to the police in the event of a claim.
In the meantime, the State Criminal Police Offices of the federal states have set up central reporting offices for crimes on the Internet, such as the Central Cybercrime Contact Point (ZAC) of the Bavarian State Criminal Police Office. Hacker attacks can be reported online there. This spares the victim a trip to the police station.
We not only report the incident to the relevant reporting center on your behalf, but also coordinate the subsequent communication between the State Criminal Police Office, the police station responsible, and any witnesses (such as your IT service provider).
No. The GDPR applies regardless of the size of the company. Even small businesses must report incidents and inform those affected if there is a significant risk. However, no action is required if the risk is very low. The decisive factor is therefore always the risk assessment, not the size of the company.
In recent years, we have already assisted a large number of companies in managing data protection incidents and submitted numerous reports to the data protection supervisory authorities. This has enabled us not only to help our clients avoid fines, but also to preserve customer trust.
