Ransomware attacks are among the biggest risks for companies. After an attack, technical, legal, and economic decisions must be made within a few hours. At the A1 Security Day 2026, Mag. Roman Taudes, LL.M., and Mag. Anela Blöch from ATB.LAW showed how companies can handle this situation.
The A1 Security Day took place on October 15, 2026, at the A1 headquarters in Vienna. Around 300 entrepreneurs, CISOs, and IT security professionals participated. The main theme was „The AI threat: Cyber security in the age of superintelligence“.
Keynote: „When AI strikes – Extortion cases in practice“
ATB.LAW has been assisting companies following hacker attacks and extortion for years. The keynote focused on the experiences gained from this practice.
Artificial intelligence is fundamentally changing cyber extortion. Phishing messages are becoming flawless and personalized. Voice and video messages can be deceptively made to appear real. Attacks are increasingly being carried out automatically. This makes smaller and medium-sized companies more vulnerable.
Panel: „Negotiations with Hackers – Numbers or Defending?“
The panel discussed one of the most difficult questions following a ransomware attack: Should a company negotiate with the attackers and, if necessary, pay them?
There is no one-size-fits-all answer. The decision depends on the individual case. In particular, the following factors are decisive:
-> the availability of intact backups
-> Nature and extent of data that is being collected
-> sanctions and money laundering regulations
-> Requirements of the cyber insurance
-> the duty of care of the management
A professional ransom negotiation can also be useful even if no payment is made in the end. It saves time, provides information about perpetrators and data flows, and can significantly reduce the claim. ATB.LAW conducts such negotiations and, if necessary, also oversees the payment settlement.
Incident Response: The first hours decide
After a hacker attack, structured action is crucial. The following steps have proven to be effective:
-> isolate affected systems and secure evidence
-> Crisis team convened with IT forensics and legal advice
-> Review reporting obligations under GDPR and NISG 2026
-> Charge withdrawn
-> Coordinate communication internally and externally
NIS-2: New obligations from October 1, 2026
From October 1, 2026, the NISG 2026 applies in Austria. It implements the European NIS-2 directive. Affected companies must implement risk management measures and report significant security incidents to the authority within staggered deadlines. The management bodies bear explicit responsibility. A ransomware attack is often a mandatory reportable incident.
Data protection: Report within 72 hours
If personal data is affected, a data protection violation is usually involved. This must be reported to the data protection authority within 72 hours in principle (Article 33 GDPR). In cases of high risk, the affected individuals must also be informed (Article 34 GDPR). The reporting obligations under the GDPR and NISG 2026 exist in parallel and should be coordinated with each other.
Our services in the event of hacker attacks
ATB.LAW comprehensively supports companies before, during, and after a cyberattack:
-> Incident Response and Crisis Management
-> Negotiating ransom with the perpetrators
-> Reports to the data protection authority and the cybersecurity authority
-> Criminal charges and representation in criminal proceedings
-> Liability and insurance issues
-> Tracking of crypto payments in collaboration with forensic partners
-> Prevention, emergency plans and NIS-2 compliance
Frequently asked questions
What is a ransomware attack?
In a ransomware attack, attackers encrypt data or systems and demand ransom, usually in cryptocurrency. They often also threaten to publish stolen data.
Is the payment of ransom money allowed in Austria?
As things currently stand, there is no general ban. However, payments to sanctioned individuals or groups are particularly not permitted. Each case requires a separate examination.
Must a ransomware attack be reported?
Often yes. If personal data is involved, the GDPR’s 72-hour deadline applies. There are additional reporting obligations for facilities within the scope of the NISG 2026.
Who helps with ransom negotiations in Austria?
ATB.LAW in Vienna conducts negotiations with extortionists and advises on all legal issues following a hacker attack.
Contact
Is your company affected by a hacker attack? Or do you want to prepare for the worst? Contact us at office@atb.law or +43 1 39 12345.
