Key points at a glance
- Payment of a ransom is not generally prohibited in Austria. However, it is inadmissible when the funds benefit sanctioned individuals or organizations. The criminal law admissibility of a ransom payment must also be examined.
- The deadlines for reporting apply regardless of negotiation or payment. This applies to Article 33 GDPR (72 hours) and to NISG-2026 facilities (early warning within 24 hours).
- Professional negotiation saves time. IT forensics and recovery can run in parallel. Regardless of any ransom payment, negotiations can yield valuable information for the decisions to be made. The amount of the ransom can (almost) always be negotiated down.
- The decision on payment is a liability issue for the management. It should be carried out on the basis of documented information.
What is a negotiation with cybercriminals?
Negotiation with cybercriminals is the structured, strategically managed communication with the perpetrators of a ransomware attack or data extortion. The goals are time savings, the verification of the perpetrators’ claims, an improvement in the company’s initial situation, and a solid basis for decision-making for the management.
A negotiation does not automatically mean that payment will be made. In many cases, it primarily serves to gather information and create time for restoring data from backups. Whether payment is ultimately made is determined by the company only after a legal and economic review. In the negotiations we have conducted, it has already happened on several occasions that we were able to determine that the perpetrators – contrary to their claims in the extortion letter – were unable to extract any data at all.
Typical extortion scenarios
Ransomware with double extortion
Ransomware is malicious software that encrypts data or entire IT systems in order to extort a ransom for the decryption. In double extortion, before encrypting the data, the perpetrators also copy it. Then they threaten to publish it on a leak page.
The demand is usually in cryptocurrency, usually Bitcoin or USDC/USDT. Security coins like Monero or zCash are rarely demanded in practice. The perpetrators set deadlines and often increase the demand after those deadlines have passed.
Data extortion without encryption
Some perpetrators do not encrypt anything. They steal data and demand money for not publishing or selling it. The systems continue to operate. The pressure arises solely from the threat of publication. There is a legal violation of data protection if personal data is affected.
Extortion by insiders or alleged insiders
A particular type of extortion is extortion by insiders, such as current or former employees. Similarly, external perpetrators often pose as insiders to make their threat more credible. Therefore, it is crucial to clarify the following before responding:
- whether the claimed data actually exist,
- who is behind the demand,
- which criminal, civil and labour law remedies are available.
An inadvertent reaction can make it difficult to identify the perpetrators.
How does a professional ransomware negotiation work?
A professional ransomware negotiation follows a coordinated strategy and is closely intertwined with IT forensics, insurers, and management. Every message to the perpetrators is planned and documented in advance.
| Phase | Contents | Purpose |
|---|---|---|
| Assessment of the situation | Identification of the perpetrator group, known modus operandi, reliability in previous cases | Realistic assessment of the options |
| Time savings | Structured, controlled communication | IT forensics and recovery run in parallel |
| Verification | „Proof of Life“: Proof that the perpetrators possess data or a functioning key, for example through testing encryption of individual files | No payment for empty threats |
| Trial | Objective discussion of the amount, terms and procedure | Improving the starting position |
| Documentation | Complete recording of all communication | Proof to insurers, authorities and social organizations |
Mag. Roman Taudes, LL.M., has completed specialized training in Ransomware Negotiation Tactics. ATB.LAW has been negotiating with criminal groups for several years. „In our practice, the original demand has been % reduced by more than 50 in a large number of cases.“ Each case is different. Therefore, no specific outcome of the negotiation can be guaranteed.
Is a ransom payment allowed in Austria?
Paying a ransom to ransomware attackers is not generally prohibited in Austria. However, it is inadmissible if the recipient is a person or organization subject to EU sanctions. In this case, payment may be punishable under the Sanctions Act of 2010.
The company that was blackmailed is a victim of criminal extortion. The payment itself is not a crime. Legal risks arise primarily from three areas:
- Sanctions law: Regulation (EU) 2019/796 allows the freezing of the assets of individuals and organizations responsible for cyberattacks. A blocking order applies. The list was last expanded in July 2026. In addition, further sanctions regimes must be examined, in particular the Russia sanctions.
- Terrorist financing: If there is a connection to a terrorist organization, section 278d of the StGB applies.
- Organ liability: Payment without sufficient verification can lead to personal liability for the management.
An Austrian high court decision on the admissibility of ransom payments in the case of ransomware is not known. Therefore, it is all the more important to carefully examine the situation before making any payment.
What reporting obligations apply in the event of a ransomware attack?
A ransomware attack can trigger several separate reporting obligations. The most important ones are the notification to the data protection authority in accordance with Article 33 of the GDPR and, for data-processing facilities, the notification under the NISG 2026. These deadlines apply regardless of whether a negotiation or payment has taken place.
| Legal basis | Addressee | First | Prerequisite |
|---|---|---|---|
| Art. 33 GDPR | Austrian Data Protection Authority | Immediately, preferably within 72 hours of being informed | Violation of the protection of personal data, unless there is a foreseeable risk to the data subjects |
| Art. 34 GDPR | Affected persons | Immediately | Expected high risk for those affected |
| NISG 2026 – Early warning | Competent CSIRT | Within 24 hours of being informed | Significant cybersecurity incident at a critical or important facility |
| NISG 2026 – Incident report | Competent CSIRT | Within 72 hours of becoming aware of it | as above |
| NISG 2026 – Final report | Competent CSIRT | Basically within one month after the incident is reported | as above |
| Industry law (e.g. DORA) | Competent supervisory authority (e.g. FMA) | Separate, sometimes shorter deadlines | Financial companies |
The NISG 2026 (BGBl. I No. 94/2025) has been in effect since October 1, 2026. It replaced the NISG 2018 and covers significantly more companies than before. § 31 of the NISG 2026 explicitly places the management bodies in charge of cybersecurity risk management. More about this in our NIG 2 article.
A criminal complaint is not a legal requirement. However, it is usually advisable, for example for insurance cases, potential claims against third parties, and international investigations.
What crimes are involved in ransomware and data extortion?
According to Austrian law, ransomware attacks regularly constitute several criminal offenses under the Criminal Code. Extortion and crimes against computer systems and data are at the forefront.
| Indictment | Contents |
|---|---|
| Section 118a StGB – Unlawful access to a computer system | Incursion into the IT system |
| Section 126a StGB – Data Corruption | Encrypting, Altering, or Making Data Inaccessible |
| Section 126b StGB – Disruption of the functionality of a computer system | Shutdown of operations |
| Sections 144, 145 StGB – Extortion, aggravated extortion | Demand for ransom under threat |
| Sections 122, 123 StGB, §§ 26a ff UWG | Violation of or investigation of business and operational secrets, especially in the case of insider dealings |
The harmed company can join the criminal proceedings as a private party. This is particularly relevant if perpetrators can be identified or assets can be seized.
According to the Federal Criminal Police Office’s Cybercrime Report 2025, the number of reports of cybercrime in the narrower sense increased from 20,246 in 2024 to 21,988 in 2025 (+8.6 %%). This refers to attacks that target IT systems themselves.
Is the management responsible for the decision regarding a payment?
The decision whether to pay a ransom is an entrepreneurial discretion. According to § 25(1a) GmbHG and § 84(1a) AktG, a managing director acts prudently when he or she makes decisions free from extraneous interests and based on adequate information for the benefit of the company. This rule is called the Business Judgment Rule.
For the practice this means that the decision should be documented. This includes in particular:
- the technical situation (backups, recovery time, data volume),
- the economic consequences of a prolonged standstill,
- the result of the sanctions review,
- the position of the cyber insurer,
- the legal risks of both options.
A decision „out of the gut“ under time pressure is the greatest risk of liability.
What should be considered when purchasing cyber insurance?
Whether a cyber insurance covers ransom payments, negotiation costs, or business interruption depends on the specific insurance terms. Many police officers see reservations regarding approval, reporting obligations, and requirements for the selection of service providers.
The violation of an obligation can lead to the insurer’s freedom to provide services under § 6 of the VersVG. The insurer should therefore be informed and involved before taking any significant steps. This applies especially before making a payment.
How is a ransom payment handled?
Payment of ransom in cryptocurrency should only be made after legal review, sanctions screening, and coordination with the insurer. The processing is carried out in a controlled and fully documented manner.
- Sanction and money laundering checks the perpetrator group and the recipient address.
- Blockchain analysis of the recipient address on connections to sanctioned actors or known criminal groups.
- Acquisition of the cryptocurrency through a regulated provider.
- Controlled payment, If appropriate, initially as a sub-sum.
- Documentation for insurance, accounting, government agencies and corporate bodies.
Important: A payment does not guarantee that the perpetrators will actually delete the data or not attack it again.
What companies should not do in an emergency
- Do not communicate with the perpetrators on your own initiative. Any careless message can weaken the negotiating position.
- No payment without sanction review and coordination with the insurer.
- Do not quickly reinstall systems. In the process, evidence that is needed for criminal proceedings and insurance is lost.
- Do not lose sight of the deadlines. They are run after knowledge, not after the completion of the analysis.
- No public statements without coordinated crisis communication.
This is how ATB.LAW supports against ransomware and data extortion
ATB.LAW combines negotiation management, legal control, blockchain analysis, and payment processing. The firm works with specialized IT forensics experts, incident response providers, and blockchain analysts. The IT experts handle containment, analysis, and recovery. ATB.LAW handles negotiation, legal advice, sanctions list review, and payment processing.
- First contact: Clarification of the most urgent steps.
- Immediate measures: Cooperation with IT forensics and insurers, review of reporting deadlines under the GDPR and NISG 2026.
- Situation: Assessment of the offender group, the affected data, and the options for action.
- Trial: Communication with the perpetrators according to a coordinated strategy.
- Draft decision: Legal and factual preparation for the management.
- Processing: If necessary, sanction review, organization and monitoring of payment.
- Follow-up: Reports, criminal charges, private investor involvement, insurance processing and claims against third parties.
As lawyers, we are subject to the legal obligation of professional secrecy. Our contribution provides an overview of the entire subject area. „Cybercrime in Austria“.
How quickly can ATB.LAW get to work?
ATB.LAW IS AVAILABLE 24/7 -> Emergency number 0043 650 8601778
Conclusion
In the case of ransomware and data extortion, the first few hours determine whether a company remains operational. Negotiations, reporting obligations, sanctions testing, insurance, and organ arrest all interact with one another. They cannot be processed one after the other. Since the NISG came into effect in 2026, the pressure on many companies has increased further. Those who coordinate negotiation and legal control from the outset create the foundation for an economically reasonable and legally defensible decision.
Your next step
Has your company been affected by a ransomware attack or data extortion? We handle negotiations with the perpetrators and review your reporting obligations under the GDPR and NISG 2026. Upon request, we assist with the sanctions review, organize the ransom and any payment. We work confidentially and in coordination with your IT forensics team and your insurer.
Write to us at:
- Mag. Roman Taudes, LL.M. – Ransomware negotiation, criminal law, cryptocurrencies: taudes@atb.law
- Dr. Stefan Knotzer LL.M. – Data protection, NISG 2026, Cyber resilience: knotzer@atb.law
- Mag. Anela Blöch LL.M. – Sanctions and money laundering checks: bloech@atb.law
FAQ Ransomware negotiation and payment:
Payment of ransom is not generally prohibited in Austria. However, it is inadmissible if the funds benefit sanctioned individuals or organizations. The EU has created its own sanctions regime for cyberattacks with the Regulation (EU) 2019/796. This list is regularly expanded. Violations can be punishable under the 2010 sanctions law. Therefore, it is advisable to verify the offender group and the recipient address before any payment is made and to document the result.
Is negotiating with ransomware attackers worth it?
A professional negotiation primarily frees up time for IT forensics and recovery. It can also be used to determine whether the perpetrators actually have the data or a working key. In many cases, the claim can also be reduced. A negotiation does not require payment. A certain outcome cannot be guaranteed.
Does a ransomware attack have to be reported to the data protection authority?
If personal data is affected, the breach must be reported to the Austrian Data Protection Authority in accordance with Article 33 GDPR immediately and, as far as possible, within 72 hours of becoming aware of it. This also applies if a ransom is paid. An exception exists only if there is no foreseeable risk to the data subjects. In cases of high risk, the data subjects must also be informed in accordance with Article 34 GDPR.
Which reporting obligations apply under the NISG 2026?
Essential and important facilities within the meaning of NISG 2026 must report significant cybersecurity incidents to the relevant CSIRT. The early warning must be submitted within 24 hours, and the incident report within 72 hours of knowledge thereof. A final report follows. NISG 2026 has been in effect since October 1, 2026. These obligations supplement the reporting requirements under the GDPR.
What to do if an employee threatens to publish data?
First, it is necessary to determine whether the threat is credible and who is actually behind it. Often, external perpetrators only pose as insiders. After that, criminal charges, civil claims under §§ 26a ff of the German Civil Code (UWG), and labor law measures are considered. Communication with the extortionist should be conducted by professional negotiators to avoid jeopardizing evidence.
Does the cyber insurance company pay the ransom?
This depends on the specific insurance terms. Many policies contain approval reservations, reporting obligations, and requirements regarding service providers. If obligations are violated, the insurer may become performance-free under § 6 of the Insurance Act. Therefore, it is advisable to involve the insurer early, before making any payments.
