Specialisms
Someone had access to your systems – you noticed it from the consequences.
An attack on IT systems is rarely only a technical event. It also touches the evidential position, possible notification and information duties, liability towards customers and contracting partners, and the question of whether claims of your own exist against those involved or against service providers. The order in which these points are worked through frequently decides what can still be proved later at all.
Circumstances
Clarify the context
Evidence
Preserve documents
Deadlines
Explain any urgency
Approach
Discuss the next steps
Immediate steps
What counts in the first hours
The following steps are technical and organisational in nature, not legal. They do not replace a review of the individual case, but they regularly improve the starting position – above all because they preserve evidence that would otherwise disappear within a few days.
Disconnect affected systems, do not switch them off
Take compromised computers and servers off the network, but leave them switched on and do not rebuild anything. A shutdown erases the volatile data in working memory, which is often the most telling material for later reconstruction of the attack path.
Reset credentials from a clean environment
Reset passwords and open sessions centrally, especially for administrative accounts, remote access and the email system – and do so from a device that is demonstrably not affected. A change made inside the compromised environment will be read along with it.
Secure log data before anything is cleaned up
Export and secure the logs from the firewall, directory service, email system and remote-access systems, together with screenshots showing date and time and the full header of suspicious messages. Many systems overwrite their logs after a few days; after that the sequence of events can no longer be proved.
Halt open payment runs
Check released and scheduled transfers as well as changes to stored bank details. A compromised mailbox is frequently used first to divert payments – the financial loss then arises separately from the technical one and is noticed later.
Do not respond to a ransom demand without review
A payment to unknown recipients can trigger legal risks of its own, for example in a sanctions and anti-money-laundering context, and it guarantees neither decryption nor the deletion of copied data. Secure the extortion letter, do not reply spontaneously and have the matter reviewed.
Clarify notification and information channels immediately
Whether a notification to a supervisory authority, information of affected individuals, a criminal complaint and a claim notification to the insurer are required depends on the facts. The time limits that apply can be very short and should therefore be clarified at once, not only after the technical investigation has been completed.
Contact & appointments
Switzerland
Zürich
United Kingdom
London
Estonia
+372 6 288 2000
France
+33 2 04 26 81 82
Netherlands
+31 970 102 51606
Germany
+49 30 41733313
WhatsAppMessage us directly
Send a WhatsApp messageOverview
What happens when corporate systems are attacked
Cybercrime, as meant here, covers very different events: unauthorised access to accounts and networks, the exfiltration of customer, personnel or design data, the encryption of entire systems coupled with a ransom demand, and the silent manipulation of payment runs. Access is only rarely forced by technical means. More often it comes from previously harvested credentials, from an unpatched system that was reachable from the internet, or from the network of a service provider that was itself compromised.
In practice, weeks often lie between the intrusion and the moment someone notices it. That time is used to reconnoitre the environment, obtain further privileges and render backups unusable before the visible part of the attack begins. For those affected, two things follow: by the time of discovery the incident is usually older than assumed, and the traces that could prove it sit in log files that overwrite themselves after a short time.
Legally, such an incident runs in several directions at once. It may be relevant under criminal law; it may trigger notification and information duties towards supervisory authorities and affected individuals; it may found liability towards customers and at the same time open the company’s own claims against a service provider whose contractual duties have been breached. These levels have different time limits and different addressees. Which of them hold in the individual case can only be assessed after a review of the contracts and of the technical findings.
Recognising the signs
How an attack shows itself
We encounter the following observations regularly before the actual loss becomes visible. Taken individually, each can be given a harmless explanation; several together are a reason to have the matter examined technically.
- Logins to company accounts from countries or at times when no one in the company is working.
- Newly created mailbox rules that automatically forward incoming messages or move them into rarely opened folders.
- Administrative accounts for which there is no instruction, or existing accounts with suddenly expanded rights.
- Backup jobs that no longer complete without an error message, or backups that can no longer be restored.
- Protective software that has been deactivated on individual servers without a documented change to that effect.
- Unusually large outbound data traffic at night or at weekends.
- Business partners who reply to messages that were never sent from your organisation.
Possible measures
Possible measures
Which of these measures holds in the individual case follows from the technical findings and from your contracts. We agree every step with you in advance; costs arise only after your express approval.
Taking the facts and setting priorities
We arrange the incident along the time limits: what must be secured at once, what must be notified and what can wait. In the first days this order is more important than the completeness of the first report.
Coordination with IT forensics
The technical investigation is carried out by specialised service providers. We formulate the questions so that their result can later also stand as evidence, and we accompany the engagement and the reporting.
Review of notification and information duties
Depending on the data affected, a notification to the supervisory authority and information of the individuals concerned may be required. We examine whether a duty exists and draft the necessary communications.
Claims against service providers and suppliers
If an external service provider was the point of entry or failed to provide contractually promised protective measures, contractual claims may come into consideration. That presupposes an evaluation of the service descriptions and of the forensic findings.
Criminal complaint and coordination with the authorities
A complaint can open investigative powers that you yourself do not have – for example towards hosting, domain and payment-service providers. Whether it is sensible in the concrete case and where it should be filed is something we examine together with you.
Communication towards customers and insurers
What you tell whom, and at what time, has immediate liability consequences. We align wording and timing with the ongoing notification and investigation processes so that the levels do not damage one another.
Prospects
What can realistically be achieved
Whether an attack can be clarified and a loss made good depends above all on where diverted funds and data have gone and who still holds them. If payments were redirected, the payment channel decides what is possible; if data were copied, their dissemination can practically no longer be undone. We therefore cannot promise a particular result, and we do not do so even when asked.
Some paths close quickly. Log data are overwritten, accounts with payment-service providers are emptied, infrastructure is shut down, and notification and claim periods run regardless of whether the technical investigation has already been completed. Other paths remain open longer – in particular contractual claims against service providers and cover claims against an insurer, because there is an identifiable addressee there.
What is realistic, therefore, is usually not restoration of the state before the attack, but an orderly working-through: secured evidence, duties fulfilled, liability contained and a reliable statement of which claims are worth pursuing and which are not. The common foundations – preservation of evidence, payment tracing and the relationship between civil and criminal action – are set out in detail in the Fraud & Scam practice area.
Frequently asked questions
Frequently asked questions on cybercrime cases
The answers describe the general framework. What applies in your case depends on the technical findings, on the data affected and on your contracts.
Related specialisms
Patterns that often overlap
Fraud rarely follows just one pattern. If your case only partly matches, related specialisms may help you understand the connections.
Phishing
Forged bank and authority messages that harvest credentials – and what to do after an approval.
Find out moreIdentity theft
Misuse of personal data for contracts and accounts – defence against claims, information requests and correction of entries.
Find out moreFake Invoice
Manipulated invoices and changed bank details in the payment run – recovery, liability questions and process security.
Find out more
Related information
Related information
- Fraud and scamsWhen fraud is suspected, payment routes, correspondence and timing are important starting points.
- Recognising signs of fraudUrgency, secrecy and extra payments before a promised withdrawal are recurring warning signs. A single feature does not replace examination of the facts.
- Fraud patterns at a glanceForged invoices, fabricated relationships and manipulated investment platforms follow different patterns. Explore how they work and possible next steps.
- Contact usDescribe your matter in a few sentences. Include only what is needed for the initial contact. Documents can be requested later through a suitable channel.
Contact
Describe your matter
An enquiry does not establish a client relationship or responsibility for monitoring deadlines. If a deadline is approaching, do not rely on this form alone.
- General information. The legal assessment depends on the circumstances of each case.