Cyberattack Lawyers in Germany

Cybercrime is a pervasive threat targeting modern technologies, including data networks, systems, and tools, and it poses significant challenges for international businesses operating in Germany. Victims of such cyber offenses and attacks encompass companies, private individuals, and public authorities. Perpetrators employ various methods to obtain sensitive data and information:

In a ransomware attack, systems, servers, or data are encrypted. Attackers typically demand a ransom for restoring access, and often threaten to publish stolen data as well. Companies must quickly determine which data has been affected, whether reporting obligations apply, how to handle the extortion attempt, and what communication is needed with authorities, insurers, customers, and employees.

Attacks involving the potential loss of personal data, trade secrets, client data, patient data, financial data, or confidential business records are especially critical. A precise legal and technical analysis is required to determine whether data has actually been affected, which categories of data are involved, and what risks arise for the individuals concerned or for the company itself.

Phishing attacks often result in stolen login credentials and compromised email accounts. Attackers can then read internal communications, manipulate payment instructions, or access confidential information. Here too, it must be assessed whether personal data has been affected and whether a data protection notification is required.

In CEO fraud, attackers impersonate management, supervisors, or business partners to induce employees to make payments or disclose sensitive information. Beyond the criminal law dimension, these cases frequently raise employment law, insurance law, and liability questions.

An attack does not always target the company directly. External IT service providers, cloud providers, software vendors, and other data processors are frequently affected instead. In these cases, the company must still determine what obligations apply to it, whether notification is required, and what information must be obtained from the service provider.

Legal and economic risks run in parallel during a cyberattack. While the IT department works to isolate and restore systems, legal obligations must be reviewed and documented at the same time. The General Data Protection Regulation (GDPR) is especially relevant here: if personal data has been compromised, the company must determine whether it must notify the competent data protection supervisory authority. Under Article 33 GDPR, notification is required without undue delay and, wherever possible, within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to the rights and freedoms of the individuals affected. Where the 72-hour deadline is missed, the notification must include reasons for the delay.

This tight deadline leaves little room to delay a legal assessment. At the same time, the notification must not be rushed or incomplete. Article 33 requires it to describe the nature of the breach, the categories and approximate number of individuals and records affected, the likely consequences, and the measures already taken or proposed. Even where only a preliminary notification is possible at first, it should still be prepared to a high legal standard, since the remaining details can follow in phases without undue further delay.

After a cyberattack, the company must first determine whether a personal data breach has occurred. Personal data may include data from customers, employees, applicants, clients, patients, users, or suppliers.

If a breach has occurred, the company must assess:

1. Which data is affected?
2. How many individuals are affected?
3. Was the data encrypted or otherwise protected?
4. Was the data only temporarily inaccessible, or was it actually accessed or extracted?
5. Does the breach pose a risk to the rights and freedoms of the affected individuals?
6. Is notification to the data protection supervisory authority required under Article 33 GDPR?
7. Does the breach meet the higher threshold under Article 34 GDPR for notifying the affected individuals directly, which applies only where there is a likely high risk to their rights and freedoms?
8. What internal documentation obligations apply?

Under Article 33(5), the company must document every personal data breach, including the facts, its effects, and the remedial action taken, so that the supervisory authority can verify compliance. This assessment should be carefully documented in all cases. Even if the conclusion is that no notification is required, the company must be able to explain and justify that decision.

Notification to affected individuals under Article 34 is not automatic even where a breach is serious. It is not required if the affected data was protected by measures such as encryption that render it unintelligible, if the company has since taken action that removes the high risk, or if individual notification would involve disproportionate effort, in which case a public communication is used instead. A supervisory authority can still require notification to individuals if it disagrees with the company’s assessment.

Communication after a cyberattack calls for care. Imprecise or inconsistent statements can increase legal risk, complicate insurance matters, or damage the trust of customers and business partners.

We support companies with the legal preparation and coordination of communication with

• Data protection supervisory authorities,
• Investigating authorities, cyber insurers,
• IT service providers,
• Customers and business partners,
• Employees,
• Affected individuals, and
• Other internal and external stakeholders.

The technical analysis of a cyberattack is a task for specialized IT forensic experts, but the forensic investigation still needs to be coordinated from a legal standpoint. It should be documented which systems were affected, when the attack was discovered, what measures were taken, and what has been established about the cause and scope of the attack.

IT forensic experts commonly preserve evidence by:

• Analysing servers for unknown processes (services crashing, unusual login activity, or failed login attempts),
• Assessing end devices for signs of tampering or conspicuous files,
• Examining network infrastructure for logs of unknown users or unusually high traffic.

It is critical that the state of the attacked system is preserved exactly as the attacker left it, rather than altered during review, since altering it can render evidence inadmissible in court.

We work with experienced IT forensic experts where needed and provide legal guidance on the technical findings. This allows companies to ensure that technical measures, evidence preservation, data protection assessment, and external communication are properly aligned.

Cyberattacks can cause substantial financial damage, including business interruption, recovery costs, IT forensics costs, communication costs, potential fines, damage claims, and reputational harm.

Whether a cyber insurance policy responds to a claim often depends on what security measures were in place, what obligations were set out in the insurance contract, and how the incident was reported and documented. For this reason, communication with insurers should be handled with legal guidance from an early stage.

Our lawyers advise on insurance questions, liability risks, and potential claims against attackers, service providers, or other parties involved.

Once the acute phase has passed, the cyberattack should be reviewed in a structured way. Companies should assess what technical and organizational measures need improvement, whether internal processes should be adjusted, and whether existing contracts with IT service providers, data processors, or insurers need to be updated.

We also support companies after the acute crisis phase with

• Data protection and compliance reviews,
• Revision of internal reporting processes,
• Development or updating of incident response plans,
• Review of data processing agreements and IT service provider contracts,
• Legal assessment of technical and organizational measures, and
• Preparation for potential follow-up inquiries from authorities.

A cyberattack is a legal, technical, and communications crisis for any company. Acting quickly and in a structured way can limit damage, meet deadlines, and reduce legal risk.

Schlun & Elseven Rechtsanwälte supports companies nationwide with cyberattacks, data protection incidents, and IT security crises. Our lawyers combine legal advice with the coordination of technical expertise, guiding companies from the initial assessment through to the final resolution of the incident.

Has your company been affected by a cyberattack? Every hour that passes can deepen the legal and economic consequences. Contact our lawyers for an immediate assessment of your situation.