The questions below offer a general framework on notifications in a ransomware attack, preservation of evidence and cybersecurity contracts. In a specific case, time limits, documents and the regulations in force are assessed separately.
Showing 1–4 of 4 questions
What legal notifications are required if a company suffers a ransomware attack?
Whether notification is required is determined according to whether the incident qualifies as a data breach and according to sector-specific obligations.
The type of data affected, system logs, the time of the incident, the scope of access and the moment the breach was detected should be recorded. The obligations to notify the KVKK Board and to inform the persons concerned, as well as other sector-specific notifications, are examined separately.
Why is the preservation of evidence important after a cyber attack?
The authenticity of digital records must be preserved in order to determine the nature of the incident and responsibility.
Log files, backups, authentication records, indicators of attack and digital forensic reports must be retained reliably. Altering or deleting records may make a possible criminal investigation and a compensation dispute more difficult.
How is liability determined in a cybersecurity service contract?
The scope of services, the obligations of prevention and response, and the fault criteria should be clearly regulated in the contract.
Response time, access authorizations, test reports, use of subcontractors and the post-incident notification plan should be made concrete. An absolute security guarantee differs from a duty of reasonable technical and administrative care.
If a data breach has occurred, should all of the company’s operations be stopped?
Such a consequence is not required in every incident; technical containment, legal notification and business continuity should be planned together.
System isolation, termination of malicious access, preservation of evidence and the scope of mandatory notifications are determined through a risk assessment. Unnecessary bulk deletion of data may hinder the clarification of the breach.