{"id":9402,"date":"2026-10-18T18:36:02","date_gmt":"2026-10-18T16:36:02","guid":{"rendered":"https:\/\/atb.law\/?post_type=blog-post&#038;p=9402"},"modified":"2026-10-19T10:44:49","modified_gmt":"2026-10-19T08:44:49","slug":"negotiation-with-cybercriminals-ransomware-extortion","status":"publish","type":"blog-post","link":"https:\/\/atb.law\/en\/blog-post\/verhandlung-mit-cyberkriminellen-ransomware-erpressung\/","title":{"rendered":"Negotiating with cybercriminals: Professional support in the event of ransomware and data extortion"},"content":{"rendered":"<h2 dir=\"ltr\" id=\"page-das-wichtigste-in-kurze\">Key points at a glance<\/h2>\n<ul dir=\"ltr\">\n<li><strong>Payment of a ransom is not generally prohibited in Austria.<\/strong> However, it is inadmissible when the funds benefit sanctioned individuals or organizations. The criminal law admissibility of a ransom payment must also be examined.<\/li>\n<li><strong>The deadlines for reporting apply regardless of negotiation or payment.<\/strong> This applies to Article 33 GDPR (72 hours) and to NISG-2026 facilities (early warning within 24 hours).<\/li>\n<li><strong>Professional negotiation saves time.<\/strong> IT forensics and recovery can run in parallel. Regardless of any ransom payment, negotiations can yield valuable information for the decisions to be made. The amount of the ransom can (almost) always be negotiated down.<\/li>\n<li><strong>The decision on payment is a liability issue for the management.<\/strong> It should be carried out on the basis of documented information.<\/li>\n<\/ul>\n<h2 dir=\"ltr\" id=\"page-was-ist-eine-verhandlung-mit-cyberkriminellen\">What is a negotiation with cybercriminals?<\/h2>\n<p dir=\"ltr\"><strong>Negotiation with cybercriminals is the structured, strategically managed communication with the perpetrators of a ransomware attack or data extortion.<\/strong> The goals are time savings, the verification of the perpetrators\u2019 claims, an improvement in the company\u2019s initial situation, and a solid basis for decision-making for the management.<\/p>\n<p dir=\"ltr\">A negotiation does not automatically mean that payment will be made. In many cases, it primarily serves to gather information and create time for restoring data from backups. Whether payment is ultimately made is determined by the company only after a legal and economic review. In the negotiations we have conducted, it has already happened on several occasions that we were able to determine that the perpetrators \u2013 contrary to their claims in the extortion letter \u2013 were unable to extract any data at all.\u00a0<\/p>\n<h2 dir=\"ltr\" id=\"page-typische-erpressungsszenarien\">Typical extortion scenarios<\/h2>\n<h4 dir=\"ltr\" id=\"page-ransomware-mit-doppelter-erpressung\">Ransomware with double extortion<\/h4>\n<p dir=\"ltr\"><strong>Ransomware is malicious software that encrypts data or entire IT systems in order to extort a ransom for the decryption.<\/strong> In double extortion, before encrypting the data, the perpetrators also copy it. Then they threaten to publish it on a leak page.<\/p>\n<p dir=\"ltr\">The demand is usually in cryptocurrency, usually Bitcoin or USDC\/USDT. Security coins like Monero or zCash are rarely demanded in practice. The perpetrators set deadlines and often increase the demand after those deadlines have passed.<\/p>\n<h4 dir=\"ltr\" id=\"page-datenerpressung-ohne-verschlusselung\">Data extortion without encryption<\/h4>\n<p dir=\"ltr\">Some perpetrators do not encrypt anything. They steal data and demand money for not publishing or selling it. The systems continue to operate. The pressure arises solely from the threat of publication. There is a legal violation of data protection if personal data is affected.<\/p>\n<h4 dir=\"ltr\" id=\"page-erpressung-durch-insider-oder-angebliche-insider\">Extortion by insiders or alleged insiders<\/h4>\n<p dir=\"ltr\">A particular type of extortion is extortion by insiders, such as current or former employees. Similarly, external perpetrators often pose as insiders to make their threat more credible. Therefore, it is crucial to clarify the following before responding:<\/p>\n<ul dir=\"ltr\">\n<li>whether the claimed data actually exist,<\/li>\n<li>who is behind the demand,<\/li>\n<li>which criminal, civil and labour law remedies are available.<\/li>\n<\/ul>\n<p dir=\"ltr\">An inadvertent reaction can make it difficult to identify the perpetrators.<\/p>\n<h2 dir=\"ltr\" id=\"page-wie-lauft-eine-professionelle-ransomware-verhandlung-ab\">How does a professional ransomware negotiation work?<\/h2>\n<p dir=\"ltr\"><strong>A professional ransomware negotiation follows a coordinated strategy and is closely intertwined with IT forensics, insurers, and management.<\/strong> Every message to the perpetrators is planned and documented in advance.<\/p>\n<div dir=\"ltr\">\n<table>\n<thead>\n<tr>\n<th scope=\"col\">Phase<\/th>\n<th scope=\"col\">Contents<\/th>\n<th scope=\"col\">Purpose<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Assessment of the situation<\/td>\n<td>Identification of the perpetrator group, known modus operandi, reliability in previous cases<\/td>\n<td>Realistic assessment of the options<\/td>\n<\/tr>\n<tr>\n<td>Time savings<\/td>\n<td>Structured, controlled communication<\/td>\n<td>IT forensics and recovery run in parallel<\/td>\n<\/tr>\n<tr>\n<td>Verification<\/td>\n<td>\u201eProof of Life\u201c: Proof that the perpetrators possess data or a functioning key, for example through testing encryption of individual files<\/td>\n<td>No payment for empty threats<\/td>\n<\/tr>\n<tr>\n<td>Trial<\/td>\n<td>Objective discussion of the amount, terms and procedure<\/td>\n<td>Improving the starting position<\/td>\n<\/tr>\n<tr>\n<td>Documentation<\/td>\n<td>Complete recording of all communication<\/td>\n<td>Proof to insurers, authorities and social organizations<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<p dir=\"ltr\">Mag. Roman Taudes, LL.M., has completed specialized training in Ransomware Negotiation Tactics. ATB.LAW has been negotiating with criminal groups for several years. \u201eIn our practice, the original demand has been % reduced by more than 50 in a large number of cases.\u201c Each case is different. Therefore, no specific outcome of the negotiation can be guaranteed.<\/p>\n<h2 dir=\"ltr\" id=\"page-ist-eine-losegeldzahlung-in-osterreich-erlaubt\">Is a ransom payment allowed in Austria?<\/h2>\n<p dir=\"ltr\"><strong>Paying a ransom to ransomware attackers is not generally prohibited in Austria.<\/strong> However, it is inadmissible if the recipient is a person or organization subject to EU sanctions. In this case, payment may be punishable under the Sanctions Act of 2010.<\/p>\n<p dir=\"ltr\">The company that was blackmailed is a victim of criminal extortion. The payment itself is not a crime. Legal risks arise primarily from three areas:<\/p>\n<ol dir=\"ltr\">\n<li><strong>Sanctions law:<\/strong> Regulation (EU) 2019\/796 allows the freezing of the assets of individuals and organizations responsible for cyberattacks. A blocking order applies. The list was last expanded in July 2026. In addition, further sanctions regimes must be examined, in particular the Russia sanctions.<\/li>\n<li><strong>Terrorist financing:<\/strong> If there is a connection to a terrorist organization, section 278d of the StGB applies.<\/li>\n<li><strong>Organ liability:<\/strong> Payment without sufficient verification can lead to personal liability for the management.<\/li>\n<\/ol>\n<p dir=\"ltr\">An Austrian high court decision on the admissibility of ransom payments in the case of ransomware is not known. Therefore, it is all the more important to carefully examine the situation before making any payment.<\/p>\n<h2 dir=\"ltr\" id=\"page-welche-meldepflichten-gelten-bei-einem-ransomware-angriff\">What reporting obligations apply in the event of a ransomware attack?<\/h2>\n<p dir=\"ltr\"><strong>A ransomware attack can trigger several separate reporting obligations.<\/strong> The most important ones are the notification to the data protection authority in accordance with Article 33 of the GDPR and, for data-processing facilities, the notification under the NISG 2026. These deadlines apply regardless of whether a negotiation or payment has taken place.<\/p>\n<div dir=\"ltr\">\n<table>\n<thead>\n<tr>\n<th scope=\"col\">Legal basis<\/th>\n<th scope=\"col\">Addressee<\/th>\n<th scope=\"col\">First<\/th>\n<th scope=\"col\">Prerequisite<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Art. 33 GDPR<\/td>\n<td>Austrian Data Protection Authority<\/td>\n<td>Immediately, preferably within 72 hours of being informed<\/td>\n<td>Violation of the protection of personal data, unless there is a foreseeable risk to the data subjects<\/td>\n<\/tr>\n<tr>\n<td>Art. 34 GDPR<\/td>\n<td>Affected persons<\/td>\n<td>Immediately<\/td>\n<td>Expected high risk for those affected<\/td>\n<\/tr>\n<tr>\n<td>NISG 2026 \u2013 Early warning<\/td>\n<td>Competent CSIRT<\/td>\n<td>Within 24 hours of being informed<\/td>\n<td>Significant cybersecurity incident at a critical or important facility<\/td>\n<\/tr>\n<tr>\n<td>NISG 2026 \u2013 Incident report<\/td>\n<td>Competent CSIRT<\/td>\n<td>Within 72 hours of becoming aware of it<\/td>\n<td>as above<\/td>\n<\/tr>\n<tr>\n<td>NISG 2026 \u2013 Final report<\/td>\n<td>Competent CSIRT<\/td>\n<td>Basically within one month after the incident is reported<\/td>\n<td>as above<\/td>\n<\/tr>\n<tr>\n<td>Industry law (e.g. DORA)<\/td>\n<td>Competent supervisory authority (e.g. FMA)<\/td>\n<td>Separate, sometimes shorter deadlines<\/td>\n<td>Financial companies<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<p dir=\"ltr\">The NISG 2026 (BGBl. I No. 94\/2025) has been in effect since October 1, 2026. It replaced the NISG 2018 and covers significantly more companies than before. \u00a7 31 of the NISG 2026 explicitly places the management bodies in charge of cybersecurity risk management. More about this in our NIG 2 article.<\/p>\n<p dir=\"ltr\">A criminal complaint is not a legal requirement. However, it is usually advisable, for example for insurance cases, potential claims against third parties, and international investigations.<\/p>\n<h2 dir=\"ltr\" id=\"page-welche-straftaten-liegen-bei-ransomware-und-datenerpressung-vor\">What crimes are involved in ransomware and data extortion?<\/h2>\n<p dir=\"ltr\"><strong>According to Austrian law, ransomware attacks regularly constitute several criminal offenses under the Criminal Code.<\/strong> Extortion and crimes against computer systems and data are at the forefront.<\/p>\n<div dir=\"ltr\">\n<table>\n<thead>\n<tr>\n<th scope=\"col\">Indictment<\/th>\n<th scope=\"col\">Contents<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Section 118a StGB \u2013 Unlawful access to a computer system<\/td>\n<td>Incursion into the IT system<\/td>\n<\/tr>\n<tr>\n<td>Section 126a StGB \u2013 Data Corruption<\/td>\n<td>Encrypting, Altering, or Making Data Inaccessible<\/td>\n<\/tr>\n<tr>\n<td>Section 126b StGB \u2013 Disruption of the functionality of a computer system<\/td>\n<td>Shutdown of operations<\/td>\n<\/tr>\n<tr>\n<td>Sections 144, 145 StGB \u2013 Extortion, aggravated extortion<\/td>\n<td>Demand for ransom under threat<\/td>\n<\/tr>\n<tr>\n<td>Sections 122, 123 StGB, \u00a7\u00a7 26a ff UWG<\/td>\n<td>Violation of or investigation of business and operational secrets, especially in the case of insider dealings<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<p dir=\"ltr\">The harmed company can join the criminal proceedings as a private party. This is particularly relevant if perpetrators can be identified or assets can be seized.<\/p>\n<p dir=\"ltr\">According to the Federal Criminal Police Office\u2019s Cybercrime Report 2025, the number of reports of cybercrime in the narrower sense increased from 20,246 in 2024 to 21,988 in 2025 (+8.6 %%). This refers to attacks that target IT systems themselves.<\/p>\n<h2 dir=\"ltr\" id=\"page-haftet-die-geschaftsfuhrung-fur-die-entscheidung-uber-eine-zahlung\">Is the management responsible for the decision regarding a payment?<\/h2>\n<p dir=\"ltr\"><strong>The decision whether to pay a ransom is an entrepreneurial discretion.<\/strong> According to \u00a7 25(1a) GmbHG and \u00a7 84(1a) AktG, a managing director acts prudently when he or she makes decisions free from extraneous interests and based on adequate information for the benefit of the company. This rule is called the Business Judgment Rule.<\/p>\n<p dir=\"ltr\">For the practice this means that the decision should be documented. This includes in particular:<\/p>\n<ul dir=\"ltr\">\n<li>the technical situation (backups, recovery time, data volume),<\/li>\n<li>the economic consequences of a prolonged standstill,<\/li>\n<li>the result of the sanctions review,<\/li>\n<li>the position of the cyber insurer,<\/li>\n<li>the legal risks of both options.<\/li>\n<\/ul>\n<p dir=\"ltr\">A decision \u201eout of the gut\u201c under time pressure is the greatest risk of liability.<\/p>\n<h2 dir=\"ltr\" id=\"page-was-ist-bei-der-cyberversicherung-zu-beachten\">What should be considered when purchasing cyber insurance?<\/h2>\n<p dir=\"ltr\"><strong>Whether a cyber insurance covers ransom payments, negotiation costs, or business interruption depends on the specific insurance terms.<\/strong> Many police officers see reservations regarding approval, reporting obligations, and requirements for the selection of service providers.<\/p>\n<p dir=\"ltr\">The violation of an obligation can lead to the insurer\u2019s freedom to provide services under \u00a7 6 of the VersVG. The insurer should therefore be informed and involved before taking any significant steps. This applies especially before making a payment.<\/p>\n<h2 dir=\"ltr\" id=\"page-wie-wird-eine-losegeldzahlung-abgewickelt\">How is a ransom payment handled?<\/h2>\n<p dir=\"ltr\"><strong>Payment of ransom in cryptocurrency should only be made after legal review, sanctions screening, and coordination with the insurer.<\/strong> The processing is carried out in a controlled and fully documented manner.<\/p>\n<ol dir=\"ltr\">\n<li><strong>Sanction and money laundering checks<\/strong> the perpetrator group and the recipient address.<\/li>\n<li><strong>Blockchain analysis of the recipient address<\/strong> on connections to sanctioned actors or known criminal groups.<\/li>\n<li><strong>Acquisition of the cryptocurrency<\/strong> through a regulated provider.<\/li>\n<li><strong>Controlled payment<\/strong>, If appropriate, initially as a sub-sum.<\/li>\n<li><strong>Documentation<\/strong> for insurance, accounting, government agencies and corporate bodies.<\/li>\n<\/ol>\n<p dir=\"ltr\">Important: A payment does not guarantee that the perpetrators will actually delete the data or not attack it again.<\/p>\n<h2 dir=\"ltr\" id=\"page-was-unternehmen-im-ernstfall-nicht-tun-sollten\">What companies should not do in an emergency<\/h2>\n<ul dir=\"ltr\">\n<li><strong>Do not communicate with the perpetrators on your own initiative.<\/strong> Any careless message can weaken the negotiating position.<\/li>\n<li><strong>No payment without sanction review and coordination with the insurer.<\/strong><\/li>\n<li><strong>Do not quickly reinstall systems.<\/strong> In the process, evidence that is needed for criminal proceedings and insurance is lost.<\/li>\n<li><strong>Do not lose sight of the deadlines.<\/strong> They are run after knowledge, not after the completion of the analysis.<\/li>\n<li><strong>No public statements without coordinated crisis communication.<\/strong><\/li>\n<\/ul>\n<h2 dir=\"ltr\" id=\"page-so-unterstutzt-atb-law-bei-ransomware-und-datenerpressung\">This is how ATB.LAW supports against ransomware and data extortion<\/h2>\n<p dir=\"ltr\">ATB.LAW combines negotiation management, legal control, blockchain analysis, and payment processing. The firm works with specialized IT forensics experts, incident response providers, and blockchain analysts. The IT experts handle containment, analysis, and recovery. ATB.LAW handles negotiation, legal advice, sanctions list review, and payment processing.<\/p>\n<ol dir=\"ltr\">\n<li><strong>First contact:<\/strong> Clarification of the most urgent steps.<\/li>\n<li><strong>Immediate measures:<\/strong> Cooperation with IT forensics and insurers, review of reporting deadlines under the GDPR and NISG 2026.<\/li>\n<li><strong>Situation:<\/strong> Assessment of the offender group, the affected data, and the options for action.<\/li>\n<li><strong>Trial:<\/strong> Communication with the perpetrators according to a coordinated strategy.<\/li>\n<li><strong>Draft decision:<\/strong> Legal and factual preparation for the management.<\/li>\n<li><strong>Processing:<\/strong> If necessary, sanction review, organization and monitoring of payment.<\/li>\n<li><strong>Follow-up:<\/strong> Reports, criminal charges, private investor involvement, insurance processing and claims against third parties.<\/li>\n<\/ol>\n<p dir=\"ltr\">As lawyers, we are subject to the legal obligation of professional secrecy. Our contribution provides an overview of the entire subject area. <a href=\"https:\/\/atb.law\/en\/blog-post\/cybercrime-austria\/\">\u201eCybercrime in Austria\u201c<\/a>.<\/p>\n<h2 dir=\"ltr\" id=\"page-wie-schnell-kann-atb-law-tatig-werden\">How quickly can ATB.LAW get to work?<\/h2>\n<p dir=\"ltr\">ATB.LAW IS AVAILABLE 24\/7 -&gt; <a href=\"tel: +43 650 860 1778\">Emergency number 0043 650 8601778<\/a>\u00a0<\/p>\n<h2 dir=\"ltr\" id=\"page-fazit\">Conclusion<\/h2>\n<p dir=\"ltr\">In the case of ransomware and data extortion, the first few hours determine whether a company remains operational. Negotiations, reporting obligations, sanctions testing, insurance, and organ arrest all interact with one another. They cannot be processed one after the other. Since the NISG came into effect in 2026, the pressure on many companies has increased further. Those who coordinate negotiation and legal control from the outset create the foundation for an economically reasonable and legally defensible decision.<\/p>\n<h2 dir=\"ltr\" id=\"page-ihr-nachster-schritt\">Your next step<\/h2>\n<p dir=\"ltr\">Has your company been affected by a ransomware attack or data extortion? We handle negotiations with the perpetrators and review your reporting obligations under the GDPR and NISG 2026. Upon request, we assist with the sanctions review, organize the ransom and any payment. We work confidentially and in coordination with your IT forensics team and your insurer.<\/p>\n<p dir=\"ltr\"><strong>Write to us at:<\/strong><\/p>\n<ul dir=\"ltr\">\n<li><strong>Mag. Roman Taudes, LL.M.<\/strong> \u2013 Ransomware negotiation, criminal law, cryptocurrencies: <a href=\"mailto:taudes@atb.law\">taudes@atb.law<\/a><\/li>\n<li><strong>Dr. Stefan Knotzer LL.M.<\/strong> \u2013 Data protection, NISG 2026, Cyber resilience: <a href=\"mailto:knotzer@atb.law\">knotzer@atb.law<\/a><\/li>\n<li><strong>Mag. Anela Bl\u00f6ch LL.M.<\/strong> \u2013 Sanctions and money laundering checks: <a href=\"mailto:bloech@atb.law\">bloech@atb.law<\/a><\/li>\n<\/ul>\n<p dir=\"ltr\">\u00a0<\/p>\n<h2 dir=\"ltr\" id=\"page-faq-losegeldverhandlung-und-losegeldzahlung\">FAQ Ransomware negotiation and payment:<\/h2>\n\n\n<div class=\"schema-faq wp-block-yoast-faq-block\"><div class=\"schema-faq-section\" id=\"faq-question-1789293140184\"><strong class=\"schema-faq-question\"><strong>Is it legal in Austria to pay ransom to ransomware attackers?<\/strong><\/strong> <p class=\"schema-faq-answer\">Payment of ransom is not generally prohibited in Austria. However, it is inadmissible if the funds benefit sanctioned individuals or organizations. The EU has created its own sanctions regime for cyberattacks with the Regulation (EU) 2019\/796. This list is regularly expanded. Violations can be punishable under the 2010 sanctions law. Therefore, it is advisable to verify the offender group and the recipient address before any payment is made and to document the result.<\/p> <\/div> <div class=\"schema-faq-section\" id=\"faq-question-1789293204717\"><strong class=\"schema-faq-question\"><br><strong>Is negotiating with ransomware attackers worth it?<\/strong><\/strong> <p class=\"schema-faq-answer\">A professional negotiation primarily frees up time for IT forensics and recovery. It can also be used to determine whether the perpetrators actually have the data or a working key. In many cases, the claim can also be reduced. A negotiation does not require payment. A certain outcome cannot be guaranteed.<\/p> <\/div> <div class=\"schema-faq-section\" id=\"faq-question-1789293294629\"><strong class=\"schema-faq-question\"><br><strong>Does a ransomware attack have to be reported to the data protection authority?<\/strong><\/strong> <p class=\"schema-faq-answer\">If personal data is affected, the breach must be reported to the Austrian Data Protection Authority in accordance with Article 33 GDPR immediately and, as far as possible, within 72 hours of becoming aware of it. This also applies if a ransom is paid. An exception exists only if there is no foreseeable risk to the data subjects. In cases of high risk, the data subjects must also be informed in accordance with Article 34 GDPR.<\/p> <\/div> <div class=\"schema-faq-section\" id=\"faq-question-1789293316419\"><strong class=\"schema-faq-question\"><br><strong>Which reporting obligations apply under the NISG 2026?<\/strong><\/strong> <p class=\"schema-faq-answer\">Essential and important facilities within the meaning of NISG 2026 must report significant cybersecurity incidents to the relevant CSIRT. The early warning must be submitted within 24 hours, and the incident report within 72 hours of knowledge thereof. A final report follows. NISG 2026 has been in effect since October 1, 2026. These obligations supplement the reporting requirements under the GDPR.<\/p> <\/div> <div class=\"schema-faq-section\" id=\"faq-question-1789293333101\"><strong class=\"schema-faq-question\"><br><strong>What to do if an employee threatens to publish data?<\/strong><\/strong> <p class=\"schema-faq-answer\">First, it is necessary to determine whether the threat is credible and who is actually behind it. Often, external perpetrators only pose as insiders. After that, criminal charges, civil claims under \u00a7\u00a7 26a ff of the German Civil Code (UWG), and labor law measures are considered. Communication with the extortionist should be conducted by professional negotiators to avoid jeopardizing evidence.<\/p> <\/div> <div class=\"schema-faq-section\" id=\"faq-question-1789293353406\"><strong class=\"schema-faq-question\"><br><strong>Does the cyber insurance company pay the ransom?<\/strong><\/strong> <p class=\"schema-faq-answer\">This depends on the specific insurance terms. Many policies contain approval reservations, reporting obligations, and requirements regarding service providers. If obligations are violated, the insurer may become performance-free under \u00a7 6 of the Insurance Act. Therefore, it is advisable to involve the insurer early, before making any payments.<\/p> <\/div> <\/div>","protected":false},"template":"","categories":[28],"class_list":["post-9402","blog-post","type-blog-post","status-publish","has-post-thumbnail","hentry","category-cybercrime"],"acf":[],"post-kategorie":"28","_post-kategorie":"field_66d947537140a","post-kurzbeschreibung":"Was Unternehmen bei Ransomware und Datenerpressung tun m\u00fcssen: Verhandlung mit den T\u00e4tern, Meldepflichten nach DSGVO und NISG 2026, Sanktionspr\u00fcfung und rechtliche Grenzen einer L\u00f6segeldzahlung in \u00d6sterreich.","_post-kurzbeschreibung":"field_66d949fe1efe2","post-beitragsbild":"9404","_post-beitragsbild":"field_66d94a4a1efe3","post-author_post-author-name":"Roman Taudes","_post-author_post-author-name":"field_66d94a801efe5","post-author_post-author-foto":"5984","_post-author_post-author-foto":"field_66d94aa11efe6","post-author":"","_post-author":"field_66d94ee2827ca","yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.8 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Verhandlung mit Cyberkriminellen bei Ransomware | ATB.LAW<\/title>\n<meta name=\"description\" content=\"L\u00f6segeldforderung erhalten? ATB.LAW: Verhandlung mit Cyberkriminellen; Rechtliche Unterst\u00fctzung; Sanktionslistenpr\u00fcfung; Organisation von L\u00f6segeld und Zahlungsabwicklung - aus einer Hand\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/atb.law\/en\/blog-post\/negotiation-with-cybercriminals-ransomware-extortion\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Verhandlung mit Cyberkriminellen bei Ransomware | ATB.LAW\" \/>\n<meta property=\"og:description\" content=\"L\u00f6segeldforderung erhalten? ATB.LAW: Verhandlung mit Cyberkriminellen; Rechtliche Unterst\u00fctzung; Sanktionslistenpr\u00fcfung; Organisation von L\u00f6segeld und Zahlungsabwicklung - aus einer Hand\" \/>\n<meta property=\"og:url\" content=\"https:\/\/atb.law\/en\/blog-post\/negotiation-with-cybercriminals-ransomware-extortion\/\" \/>\n<meta property=\"og:site_name\" content=\"ATB.LAW\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-19T08:44:49+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/atb.law\/wp-content\/uploads\/2026\/10\/vorschaubild-verhandlung-mit-cyberkriminellen-mittig-gesamt.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1600\" \/>\n\t<meta property=\"og:image:height\" content=\"1200\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"12 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":[\"WebPage\",\"FAQPage\"],\"@id\":\"https:\\\/\\\/atb.law\\\/blog-post\\\/verhandlung-mit-cyberkriminellen-ransomware-erpressung\\\/\",\"url\":\"https:\\\/\\\/atb.law\\\/blog-post\\\/verhandlung-mit-cyberkriminellen-ransomware-erpressung\\\/\",\"name\":\"Verhandlung mit Cyberkriminellen bei Ransomware | ATB.LAW\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/atb.law\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/atb.law\\\/blog-post\\\/verhandlung-mit-cyberkriminellen-ransomware-erpressung\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/atb.law\\\/blog-post\\\/verhandlung-mit-cyberkriminellen-ransomware-erpressung\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/atb.law\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/vorschaubild-verhandlung-mit-cyberkriminellen-mittig-gesamt.png\",\"datePublished\":\"2026-10-18T16:36:02+00:00\",\"dateModified\":\"2026-10-19T08:44:49+00:00\",\"description\":\"L\u00f6segeldforderung erhalten? ATB.LAW: Verhandlung mit Cyberkriminellen; Rechtliche Unterst\u00fctzung; Sanktionslistenpr\u00fcfung; Organisation von L\u00f6segeld und Zahlungsabwicklung - aus einer Hand\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/atb.law\\\/blog-post\\\/verhandlung-mit-cyberkriminellen-ransomware-erpressung\\\/#breadcrumb\"},\"mainEntity\":[{\"@id\":\"https:\\\/\\\/atb.law\\\/blog-post\\\/verhandlung-mit-cyberkriminellen-ransomware-erpressung\\\/#faq-question-1789293140184\"},{\"@id\":\"https:\\\/\\\/atb.law\\\/blog-post\\\/verhandlung-mit-cyberkriminellen-ransomware-erpressung\\\/#faq-question-1789293204717\"},{\"@id\":\"https:\\\/\\\/atb.law\\\/blog-post\\\/verhandlung-mit-cyberkriminellen-ransomware-erpressung\\\/#faq-question-1789293294629\"},{\"@id\":\"https:\\\/\\\/atb.law\\\/blog-post\\\/verhandlung-mit-cyberkriminellen-ransomware-erpressung\\\/#faq-question-1789293316419\"},{\"@id\":\"https:\\\/\\\/atb.law\\\/blog-post\\\/verhandlung-mit-cyberkriminellen-ransomware-erpressung\\\/#faq-question-1789293333101\"},{\"@id\":\"https:\\\/\\\/atb.law\\\/blog-post\\\/verhandlung-mit-cyberkriminellen-ransomware-erpressung\\\/#faq-question-1789293353406\"}],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/atb.law\\\/blog-post\\\/verhandlung-mit-cyberkriminellen-ransomware-erpressung\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/atb.law\\\/blog-post\\\/verhandlung-mit-cyberkriminellen-ransomware-erpressung\\\/#primaryimage\",\"url\":\"https:\\\/\\\/atb.law\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/vorschaubild-verhandlung-mit-cyberkriminellen-mittig-gesamt.png\",\"contentUrl\":\"https:\\\/\\\/atb.law\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/vorschaubild-verhandlung-mit-cyberkriminellen-mittig-gesamt.png\",\"width\":1600,\"height\":1200},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/atb.law\\\/blog-post\\\/verhandlung-mit-cyberkriminellen-ransomware-erpressung\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/atb.law\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Verhandlung mit Cyberkriminellen: Professionelle Unterst\u00fctzung bei Ransomware und Datenerpressung\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/atb.law\\\/#website\",\"url\":\"https:\\\/\\\/atb.law\\\/\",\"name\":\"atb Rechtsanw\u00e4lte\",\"description\":\"Rechtsanwaltskanzlei in Wien\",\"publisher\":{\"@id\":\"https:\\\/\\\/atb.law\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/atb.law\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/atb.law\\\/#organization\",\"name\":\"atb Rechtsanw\u00e4lte\",\"url\":\"https:\\\/\\\/atb.law\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/atb.law\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/atb.law\\\/wp-content\\\/uploads\\\/2024\\\/05\\\/ATB_Rechtsanwaelte_site-logo-beige.png\",\"contentUrl\":\"https:\\\/\\\/atb.law\\\/wp-content\\\/uploads\\\/2024\\\/05\\\/ATB_Rechtsanwaelte_site-logo-beige.png\",\"width\":1572,\"height\":1110,\"caption\":\"atb Rechtsanw\u00e4lte\"},\"image\":{\"@id\":\"https:\\\/\\\/atb.law\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Question\",\"@id\":\"https:\\\/\\\/atb.law\\\/blog-post\\\/verhandlung-mit-cyberkriminellen-ransomware-erpressung\\\/#faq-question-1789293140184\",\"position\":1,\"url\":\"https:\\\/\\\/atb.law\\\/blog-post\\\/verhandlung-mit-cyberkriminellen-ransomware-erpressung\\\/#faq-question-1789293140184\",\"name\":\"Ist es in \u00d6sterreich erlaubt, L\u00f6segeld an Ransomware-T\u00e4ter zu zahlen?\",\"answerCount\":1,\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Eine L\u00f6segeldzahlung ist in \u00d6sterreich nicht generell verboten. Sie ist aber unzul\u00e4ssig, wenn die Mittel sanktionierten Personen oder Organisationen zugutekommen. Die EU hat daf\u00fcr mit der Verordnung (EU) 2019\\\/796 ein eigenes Sanktionsregime f\u00fcr Cyberangriffe geschaffen. Dessen Liste wird regelm\u00e4\u00dfig erweitert. Ein Versto\u00df kann nach dem Sanktionengesetz 2010 strafbar sein. Vor jeder Zahlung sollten daher T\u00e4tergruppe und Empf\u00e4ngeradresse gepr\u00fcft und das Ergebnis dokumentiert werden.\",\"inLanguage\":\"en-US\"},\"inLanguage\":\"en-US\"},{\"@type\":\"Question\",\"@id\":\"https:\\\/\\\/atb.law\\\/blog-post\\\/verhandlung-mit-cyberkriminellen-ransomware-erpressung\\\/#faq-question-1789293204717\",\"position\":2,\"url\":\"https:\\\/\\\/atb.law\\\/blog-post\\\/verhandlung-mit-cyberkriminellen-ransomware-erpressung\\\/#faq-question-1789293204717\",\"name\":\"Lohnt sich eine Verhandlung mit Ransomware-T\u00e4tern?\",\"answerCount\":1,\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Eine professionelle Verhandlung verschafft vor allem Zeit f\u00fcr IT-Forensik und Wiederherstellung. Au\u00dferdem l\u00e4sst sich pr\u00fcfen, ob die T\u00e4ter tats\u00e4chlich \u00fcber Daten oder einen funktionierenden Schl\u00fcssel verf\u00fcgen. In vielen F\u00e4llen kann auch die Forderung gesenkt werden. Eine Verhandlung verpflichtet nicht zur Zahlung. Ein bestimmtes Ergebnis kann nicht garantiert werden.\",\"inLanguage\":\"en-US\"},\"inLanguage\":\"en-US\"},{\"@type\":\"Question\",\"@id\":\"https:\\\/\\\/atb.law\\\/blog-post\\\/verhandlung-mit-cyberkriminellen-ransomware-erpressung\\\/#faq-question-1789293294629\",\"position\":3,\"url\":\"https:\\\/\\\/atb.law\\\/blog-post\\\/verhandlung-mit-cyberkriminellen-ransomware-erpressung\\\/#faq-question-1789293294629\",\"name\":\"Muss ein Ransomware-Angriff der Datenschutzbeh\u00f6rde gemeldet werden?\",\"answerCount\":1,\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Sind personenbezogene Daten betroffen, ist die Verletzung nach Art. 33 DSGVO grunds\u00e4tzlich unverz\u00fcglich und m\u00f6glichst binnen 72 Stunden ab Kenntnis an die \u00f6sterreichische Datenschutzbeh\u00f6rde zu melden. Das gilt auch, wenn ein L\u00f6segeld gezahlt wird. Eine Ausnahme besteht nur, wenn voraussichtlich kein Risiko f\u00fcr die Betroffenen besteht. Bei hohem Risiko sind nach Art. 34 DSGVO auch die betroffenen Personen zu informieren.\",\"inLanguage\":\"en-US\"},\"inLanguage\":\"en-US\"},{\"@type\":\"Question\",\"@id\":\"https:\\\/\\\/atb.law\\\/blog-post\\\/verhandlung-mit-cyberkriminellen-ransomware-erpressung\\\/#faq-question-1789293316419\",\"position\":4,\"url\":\"https:\\\/\\\/atb.law\\\/blog-post\\\/verhandlung-mit-cyberkriminellen-ransomware-erpressung\\\/#faq-question-1789293316419\",\"name\":\"Welche Meldepflichten gelten nach dem NISG 2026?\",\"answerCount\":1,\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Wesentliche und wichtige Einrichtungen im Sinne des NISG 2026 m\u00fcssen erhebliche Cybersicherheitsvorf\u00e4lle an das zust\u00e4ndige CSIRT melden. Die Fr\u00fchwarnung ist binnen 24 Stunden abzugeben, die Vorfallsmeldung binnen 72 Stunden ab Kenntnis. Danach folgt ein Abschlussbericht. Das NISG 2026 ist seit 1. Oktober 2026 in Kraft. Diese Pflichten bestehen zus\u00e4tzlich zur Meldung nach der DSGVO.\",\"inLanguage\":\"en-US\"},\"inLanguage\":\"en-US\"},{\"@type\":\"Question\",\"@id\":\"https:\\\/\\\/atb.law\\\/blog-post\\\/verhandlung-mit-cyberkriminellen-ransomware-erpressung\\\/#faq-question-1789293333101\",\"position\":5,\"url\":\"https:\\\/\\\/atb.law\\\/blog-post\\\/verhandlung-mit-cyberkriminellen-ransomware-erpressung\\\/#faq-question-1789293333101\",\"name\":\"Was tun, wenn ein Mitarbeiter mit der Ver\u00f6ffentlichung von Daten droht?\",\"answerCount\":1,\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Zun\u00e4chst ist zu kl\u00e4ren, ob die Drohung glaubhaft ist und wer tats\u00e4chlich dahintersteht. Nicht selten geben sich externe T\u00e4ter nur als Insider aus. Danach kommen Strafanzeige, zivilrechtliche Anspr\u00fcche nach \u00a7\u00a7 26a ff UWG und arbeitsrechtliche Ma\u00dfnahmen in Betracht. Die Kommunikation mit der erpressenden Person sollte von professionellen Verhandlern und abgestimmt erfolgen, um Beweise nicht zu gef\u00e4hrden.\",\"inLanguage\":\"en-US\"},\"inLanguage\":\"en-US\"},{\"@type\":\"Question\",\"@id\":\"https:\\\/\\\/atb.law\\\/blog-post\\\/verhandlung-mit-cyberkriminellen-ransomware-erpressung\\\/#faq-question-1789293353406\",\"position\":6,\"url\":\"https:\\\/\\\/atb.law\\\/blog-post\\\/verhandlung-mit-cyberkriminellen-ransomware-erpressung\\\/#faq-question-1789293353406\",\"name\":\"\u00dcbernimmt die Cyberversicherung das L\u00f6segeld?\",\"answerCount\":1,\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Das h\u00e4ngt von den konkreten Versicherungsbedingungen ab. Viele Polizzen enthalten Zustimmungsvorbehalte, Anzeigeobliegenheiten und Vorgaben zu Dienstleistern. Werden Obliegenheiten verletzt, kann der Versicherer nach \u00a7 6 VersVG leistungsfrei werden. Der Versicherer sollte daher fr\u00fch und vor einer Zahlung eingebunden werden.\",\"inLanguage\":\"en-US\"},\"inLanguage\":\"en-US\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Negotiation with cybercriminals regarding ransomware | ATB.LAW","description":"Receiving a ransom demand? ATB.LAW: Negotiating with cybercriminals; Legal support; Sanction list verification; Organization of ransom and payment processing \u2013 all from a single source","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/atb.law\/en\/blog-post\/negotiation-with-cybercriminals-ransomware-extortion\/","og_locale":"en_US","og_type":"article","og_title":"Verhandlung mit Cyberkriminellen bei Ransomware | ATB.LAW","og_description":"L\u00f6segeldforderung erhalten? ATB.LAW: Verhandlung mit Cyberkriminellen; Rechtliche Unterst\u00fctzung; Sanktionslistenpr\u00fcfung; Organisation von L\u00f6segeld und Zahlungsabwicklung - aus einer Hand","og_url":"https:\/\/atb.law\/en\/blog-post\/negotiation-with-cybercriminals-ransomware-extortion\/","og_site_name":"ATB.LAW","article_modified_time":"2026-10-19T08:44:49+00:00","og_image":[{"width":1600,"height":1200,"url":"https:\/\/atb.law\/wp-content\/uploads\/2026\/10\/vorschaubild-verhandlung-mit-cyberkriminellen-mittig-gesamt.png","type":"image\/png"}],"twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"12 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":["WebPage","FAQPage"],"@id":"https:\/\/atb.law\/blog-post\/verhandlung-mit-cyberkriminellen-ransomware-erpressung\/","url":"https:\/\/atb.law\/blog-post\/verhandlung-mit-cyberkriminellen-ransomware-erpressung\/","name":"Negotiation with cybercriminals regarding ransomware | ATB.LAW","isPartOf":{"@id":"https:\/\/atb.law\/#website"},"primaryImageOfPage":{"@id":"https:\/\/atb.law\/blog-post\/verhandlung-mit-cyberkriminellen-ransomware-erpressung\/#primaryimage"},"image":{"@id":"https:\/\/atb.law\/blog-post\/verhandlung-mit-cyberkriminellen-ransomware-erpressung\/#primaryimage"},"thumbnailUrl":"https:\/\/atb.law\/wp-content\/uploads\/2026\/10\/vorschaubild-verhandlung-mit-cyberkriminellen-mittig-gesamt.png","datePublished":"2026-10-18T16:36:02+00:00","dateModified":"2026-10-19T08:44:49+00:00","description":"Receiving a ransom demand? ATB.LAW: Negotiating with cybercriminals; Legal support; Sanction list verification; Organization of ransom and payment processing \u2013 all from a single source","breadcrumb":{"@id":"https:\/\/atb.law\/blog-post\/verhandlung-mit-cyberkriminellen-ransomware-erpressung\/#breadcrumb"},"mainEntity":[{"@id":"https:\/\/atb.law\/blog-post\/verhandlung-mit-cyberkriminellen-ransomware-erpressung\/#faq-question-1789293140184"},{"@id":"https:\/\/atb.law\/blog-post\/verhandlung-mit-cyberkriminellen-ransomware-erpressung\/#faq-question-1789293204717"},{"@id":"https:\/\/atb.law\/blog-post\/verhandlung-mit-cyberkriminellen-ransomware-erpressung\/#faq-question-1789293294629"},{"@id":"https:\/\/atb.law\/blog-post\/verhandlung-mit-cyberkriminellen-ransomware-erpressung\/#faq-question-1789293316419"},{"@id":"https:\/\/atb.law\/blog-post\/verhandlung-mit-cyberkriminellen-ransomware-erpressung\/#faq-question-1789293333101"},{"@id":"https:\/\/atb.law\/blog-post\/verhandlung-mit-cyberkriminellen-ransomware-erpressung\/#faq-question-1789293353406"}],"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/atb.law\/blog-post\/verhandlung-mit-cyberkriminellen-ransomware-erpressung\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/atb.law\/blog-post\/verhandlung-mit-cyberkriminellen-ransomware-erpressung\/#primaryimage","url":"https:\/\/atb.law\/wp-content\/uploads\/2026\/10\/vorschaubild-verhandlung-mit-cyberkriminellen-mittig-gesamt.png","contentUrl":"https:\/\/atb.law\/wp-content\/uploads\/2026\/10\/vorschaubild-verhandlung-mit-cyberkriminellen-mittig-gesamt.png","width":1600,"height":1200},{"@type":"BreadcrumbList","@id":"https:\/\/atb.law\/blog-post\/verhandlung-mit-cyberkriminellen-ransomware-erpressung\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/atb.law\/"},{"@type":"ListItem","position":2,"name":"Verhandlung mit Cyberkriminellen: Professionelle Unterst\u00fctzung bei Ransomware und Datenerpressung"}]},{"@type":"WebSite","@id":"https:\/\/atb.law\/#website","url":"https:\/\/atb.law\/","name":"atb Attorneys at Law","description":"Law firm in Vienna","publisher":{"@id":"https:\/\/atb.law\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/atb.law\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/atb.law\/#organization","name":"atb Attorneys at Law","url":"https:\/\/atb.law\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/atb.law\/#\/schema\/logo\/image\/","url":"https:\/\/atb.law\/wp-content\/uploads\/2024\/05\/ATB_Rechtsanwaelte_site-logo-beige.png","contentUrl":"https:\/\/atb.law\/wp-content\/uploads\/2024\/05\/ATB_Rechtsanwaelte_site-logo-beige.png","width":1572,"height":1110,"caption":"atb Rechtsanw\u00e4lte"},"image":{"@id":"https:\/\/atb.law\/#\/schema\/logo\/image\/"}},{"@type":"Question","@id":"https:\/\/atb.law\/blog-post\/verhandlung-mit-cyberkriminellen-ransomware-erpressung\/#faq-question-1789293140184","position":1,"url":"https:\/\/atb.law\/blog-post\/verhandlung-mit-cyberkriminellen-ransomware-erpressung\/#faq-question-1789293140184","name":"Is it legal in Austria to pay ransom to ransomware attackers?","answerCount":1,"acceptedAnswer":{"@type":"Answer","text":"Eine L\u00f6segeldzahlung ist in \u00d6sterreich nicht generell verboten. Sie ist aber unzul\u00e4ssig, wenn die Mittel sanktionierten Personen oder Organisationen zugutekommen. Die EU hat daf\u00fcr mit der Verordnung (EU) 2019\/796 ein eigenes Sanktionsregime f\u00fcr Cyberangriffe geschaffen. Dessen Liste wird regelm\u00e4\u00dfig erweitert. Ein Versto\u00df kann nach dem Sanktionengesetz 2010 strafbar sein. Vor jeder Zahlung sollten daher T\u00e4tergruppe und Empf\u00e4ngeradresse gepr\u00fcft und das Ergebnis dokumentiert werden.","inLanguage":"en-US"},"inLanguage":"en-US"},{"@type":"Question","@id":"https:\/\/atb.law\/blog-post\/verhandlung-mit-cyberkriminellen-ransomware-erpressung\/#faq-question-1789293204717","position":2,"url":"https:\/\/atb.law\/blog-post\/verhandlung-mit-cyberkriminellen-ransomware-erpressung\/#faq-question-1789293204717","name":"Is negotiating with ransomware attackers worth it?","answerCount":1,"acceptedAnswer":{"@type":"Answer","text":"Eine professionelle Verhandlung verschafft vor allem Zeit f\u00fcr IT-Forensik und Wiederherstellung. Au\u00dferdem l\u00e4sst sich pr\u00fcfen, ob die T\u00e4ter tats\u00e4chlich \u00fcber Daten oder einen funktionierenden Schl\u00fcssel verf\u00fcgen. In vielen F\u00e4llen kann auch die Forderung gesenkt werden. Eine Verhandlung verpflichtet nicht zur Zahlung. Ein bestimmtes Ergebnis kann nicht garantiert werden.","inLanguage":"en-US"},"inLanguage":"en-US"},{"@type":"Question","@id":"https:\/\/atb.law\/blog-post\/verhandlung-mit-cyberkriminellen-ransomware-erpressung\/#faq-question-1789293294629","position":3,"url":"https:\/\/atb.law\/blog-post\/verhandlung-mit-cyberkriminellen-ransomware-erpressung\/#faq-question-1789293294629","name":"Does a ransomware attack have to be reported to the data protection authority?","answerCount":1,"acceptedAnswer":{"@type":"Answer","text":"Sind personenbezogene Daten betroffen, ist die Verletzung nach Art. 33 DSGVO grunds\u00e4tzlich unverz\u00fcglich und m\u00f6glichst binnen 72 Stunden ab Kenntnis an die \u00f6sterreichische Datenschutzbeh\u00f6rde zu melden. Das gilt auch, wenn ein L\u00f6segeld gezahlt wird. Eine Ausnahme besteht nur, wenn voraussichtlich kein Risiko f\u00fcr die Betroffenen besteht. Bei hohem Risiko sind nach Art. 34 DSGVO auch die betroffenen Personen zu informieren.","inLanguage":"en-US"},"inLanguage":"en-US"},{"@type":"Question","@id":"https:\/\/atb.law\/blog-post\/verhandlung-mit-cyberkriminellen-ransomware-erpressung\/#faq-question-1789293316419","position":4,"url":"https:\/\/atb.law\/blog-post\/verhandlung-mit-cyberkriminellen-ransomware-erpressung\/#faq-question-1789293316419","name":"Which reporting obligations apply under the NISG 2026?","answerCount":1,"acceptedAnswer":{"@type":"Answer","text":"Wesentliche und wichtige Einrichtungen im Sinne des NISG 2026 m\u00fcssen erhebliche Cybersicherheitsvorf\u00e4lle an das zust\u00e4ndige CSIRT melden. Die Fr\u00fchwarnung ist binnen 24 Stunden abzugeben, die Vorfallsmeldung binnen 72 Stunden ab Kenntnis. Danach folgt ein Abschlussbericht. Das NISG 2026 ist seit 1. Oktober 2026 in Kraft. Diese Pflichten bestehen zus\u00e4tzlich zur Meldung nach der DSGVO.","inLanguage":"en-US"},"inLanguage":"en-US"},{"@type":"Question","@id":"https:\/\/atb.law\/blog-post\/verhandlung-mit-cyberkriminellen-ransomware-erpressung\/#faq-question-1789293333101","position":5,"url":"https:\/\/atb.law\/blog-post\/verhandlung-mit-cyberkriminellen-ransomware-erpressung\/#faq-question-1789293333101","name":"What to do if an employee threatens to publish data?","answerCount":1,"acceptedAnswer":{"@type":"Answer","text":"Zun\u00e4chst ist zu kl\u00e4ren, ob die Drohung glaubhaft ist und wer tats\u00e4chlich dahintersteht. Nicht selten geben sich externe T\u00e4ter nur als Insider aus. Danach kommen Strafanzeige, zivilrechtliche Anspr\u00fcche nach \u00a7\u00a7 26a ff UWG und arbeitsrechtliche Ma\u00dfnahmen in Betracht. Die Kommunikation mit der erpressenden Person sollte von professionellen Verhandlern und abgestimmt erfolgen, um Beweise nicht zu gef\u00e4hrden.","inLanguage":"en-US"},"inLanguage":"en-US"},{"@type":"Question","@id":"https:\/\/atb.law\/blog-post\/verhandlung-mit-cyberkriminellen-ransomware-erpressung\/#faq-question-1789293353406","position":6,"url":"https:\/\/atb.law\/blog-post\/verhandlung-mit-cyberkriminellen-ransomware-erpressung\/#faq-question-1789293353406","name":"Does the cyber insurance company pay the ransom?","answerCount":1,"acceptedAnswer":{"@type":"Answer","text":"Das h\u00e4ngt von den konkreten Versicherungsbedingungen ab. Viele Polizzen enthalten Zustimmungsvorbehalte, Anzeigeobliegenheiten und Vorgaben zu Dienstleistern. Werden Obliegenheiten verletzt, kann der Versicherer nach \u00a7 6 VersVG leistungsfrei werden. Der Versicherer sollte daher fr\u00fch und vor einer Zahlung eingebunden werden.","inLanguage":"en-US"},"inLanguage":"en-US"}]}},"_links":{"self":[{"href":"https:\/\/atb.law\/en\/wp-json\/wp\/v2\/blog-post\/9402","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/atb.law\/en\/wp-json\/wp\/v2\/blog-post"}],"about":[{"href":"https:\/\/atb.law\/en\/wp-json\/wp\/v2\/types\/blog-post"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/atb.law\/en\/wp-json\/wp\/v2\/media\/9404"}],"wp:attachment":[{"href":"https:\/\/atb.law\/en\/wp-json\/wp\/v2\/media?parent=9402"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/atb.law\/en\/wp-json\/wp\/v2\/categories?post=9402"}],"curies":[{"name":"Well played","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}