Starting point
value chain solutions has operated a SaaS data platform for sales and logistics since 2003. Around 20 customers use it every day for reporting, data analysis and automated replenishment. If the platform fails, they lack reports and order proposals in their day-to-day business.
The incident
During the night before a Thursday in March 2026, an attacker encrypted the internal systems – including the virtualisation layer and the internal backup. The customer platform runs in a separate environment; when the attack was discovered, most of it was not yet encrypted. We disconnected it from the network immediately, shut it down in a controlled way and cut the entire internet connection. As a result, the platform was unavailable to customers until day 4. Only email via Exchange Online and telephony via VoIP still worked. The external backups were complete and accessible at all times, including current distribution lists of all customers.
The cause
The entry point was an insufficiently protected access point on the firewall. Because internal protection and detection mechanisms were inadequate, the attacker was able to prepare the attack unnoticed for about five weeks.
My role: leading the crisis team
Within a few hours the crisis team was in place: internal IT, the head of development, an IT security provider, an incident response consultant and, from day 1, a specialist lawyer. I delegated all technical work. Decisions, prioritisation, finance, legal, payment handling and communication stayed with me.
For the first three days the team met twice a day, then daily. Crisis leadership works on a military principle, not by consensus: gather and weigh the experts' input and concerns, decide, instruct clearly.
The hardest decision
Pay or not? The data was safe in the external backup, but the systems were encrypted. A rebuild would have meant a step-by-step restart over 2 to 4 weeks, with an uncertain outcome. The forensic experts rated decrypting ourselves as unlikely and very time-consuming. On day 1, I decided to buy the attackers' decryptor and prepared a fallback plan in parallel, based on the forensic assessment, our financial scenarios and advice from a specialist lawyer.
Communication
A few hours after discovery, an open email went to all customers, followed by an update every working day. I called key customers personally. One customer escalated; more attention calmed things down quickly. No customer left.
Result
First customer services ran after 4 days, full operation after 6 days. The customer systems were the first to go live again on day 4: they were not encrypted and had been cleared by the forensic team. At the same time, we opened communication in a controlled way for reduced services. No customer data was deleted, and no ongoing data was lost during the outage. After about 12 weeks normal operations were restored; the security measures have been implemented step by step since then.
My most important lesson
On day one I reported the incident to the BSI – and assumed this also fulfilled the GDPR reporting obligation. That was a mistake: the report to the data protection authority was submitted later with the help of our lawyer. A voluntary report to the BSI does not replace the report to the data protection authority.
Being prepared
Technical security lowers the likelihood of an attack. Whether a company survives one depends on its preparation:
- Documentation: systems, data, dependencies, restart sequence and contact lists, stored outside your own IT
- Plans: emergency plan without IT, roles and rhythm of the crisis team, decision framework for the payment question, communication templates
- Systems: separated, tested backup, communication outside your own infrastructure, a prepared payment route
- Processes: reporting channels (data protection, BSI where applicable), restart by customer priority, payment approval, regular exercises
- Structures: clear responsibility for outsourced IT security, partners agreed in advance, insurance, protection of shareholder liability
“When the value chain solutions platform was hit by a cyber attack in March 2026, Mr Wabersich led the crisis organisation calmly and in a structured way. Communication with us was open and timely throughout; we knew at every point where the recovery stood. First services were available again after a few days, and full operation was restored after six days, without data loss. We would work with him again at any time and recommend him for situations that call for reliability and clear leadership.”
What I bring
Forensics and IT security solve the technical problem. I take on everything else on the company side: as interim managing director or fractional crisis manager, from day one. And before an emergency, with the cyber readiness check: from the management perspective, I review whether your company is prepared, can resolve a crisis and can then restore a secure state – complementing IT security and mandatory NIS2 training.