Ransomware in Berlin: managing the crisis once the data is already out
A ransomware attack with data theft in Berlin shows once again that extortion no longer depends on encryption alone. Once information leaves the organisation, ransomware response becomes as much a legal and communication matter as a technical one.
News summary
The Berlin case reported by Reuters fits the pattern that has dominated for several years: attackers encrypt systems, but first they take the information. Extortion is no longer only about restoring access to data, but about not publishing it. That changes the nature of the response completely.
A company with impeccable backups can restore its servers in hours and still have a serious problem: contracts, payroll, case files or customer data in someone else's hands. Backups solve availability; they do not solve confidentiality.
At Seintec we stress a point that is usually discovered too late: the most expensive phase of modern ransomware is not restoration, it is establishing exactly what was taken. Without sufficient logs — of access, outbound traffic and activity on file servers — that question has no answer, and without an answer you cannot notify correctly or negotiate on any informed basis.
In the European framework, the clock is also running. Notification to the supervisory authority and, where applicable, to affected individuals carries demanding deadlines. An organisation that discovers the incident on a Friday afternoon and has not decided who leads, who speaks to the regulator and who speaks to customers loses its first useful hours.
The practical recommendation is to prepare the crisis while calm: a technical response contact available out of hours, an identified legal adviser, a single spokesperson and baseline messages for customers and employees. It does not remove the damage, but it stops improvisation from multiplying it.
On the preventive side, three controls still concentrate most of the value: multi-factor authentication on every remote access, segmentation that prevents free movement across the network, and immutable backups outside the domain, verified with real restorations.
Source: Reuters — 5 September 2026
Why this matters to a company operating in Spain
The threat landscape affecting Spanish companies no longer distinguishes by size. Attacks are automated, sold as a service, and seek the shortest path: a reused credential, an unpatched server, or a provider with poorly controlled remote access. For an SME, the difference between a minor scare and a multi-day shutdown almost always depends on decisions made before the incident.
That is why every industry update should be read in operational terms: which specific controls would have prevented the problem, what evidence must be preserved, and who makes the decision when the clock is ticking. This is the approach we apply to managed cybersecurity projects at Seintec.
Real business impact
Before deciding on an investment, it is advisable to identify what is at stake. In cybersecurity projects, we typically review these four areas with management and the IT manager:
- Operational disruption: orders, invoicing, or production halted while systems are restored.
- Loss or exposure of personal data, with a mandatory 72-hour notification requirement to the AEPD.
- Hidden cost of recovery: overtime, external hiring, and loss of client trust.
- Contractual and compliance requirements (ENS, NIS2, ISO 27001) that demand evidence, not intentions.
Five-step action plan
A useful plan fits on one page. This is the roadmap we apply with our clients to move from news to measurable improvement, without disrupting daily operations:
- Confirm the scope with evidence: which machines, which accounts and what volume of data left the organisation.
- Isolate without destroying: contain affected systems while preserving logs and memory for later analysis.
- Convene the crisis committee with management, technical, legal and communications, and appoint a single spokesperson.
- Restore from verified immutable backups and only onto rebuilt systems, never onto compromised ones.
- Notify the supervisory authority and affected individuals within the deadline where applicable, and document every decision.
Key indicators you should be measuring
What is not measured is not managed. These indicators allow you to verify if the technological investment is yielding results and serve as the basis for the periodic reports we deliver to our clients:
- Mean time to detect and mean time to contain an incident (MTTD and MTTC).
- Percentage of remote and privileged access protected with multi-factor authentication.
- How recently the last restoration from an immutable backup was tested.
- Logging coverage: retention in days and systems included.
How we approach it at Seintec: Cybersecurity
We shield your company so it never stops. We operate from our own datacenter in Spain, with a certified technical team and a single point of contact who knows your infrastructure, so you do not have to explain your environment every time an incident arises.
These are the capabilities we bring to the table in a cybersecurity project:
- EDR / XDR: Advanced detection and response across endpoints and network.
- UTM perimeter security: Managed firewall and segmentation.
- Email filtering: Phishing, spam, and spoofing blocking.
- WAF: Protection of published applications and services.
- Immutable backup: Backups that ransomware cannot alter.
- MFA and identity: Conditional access based on user and device.
What you gain by working with a technology partner
Outsourcing does not mean losing control: it means gaining predictability, coverage, and independent technical insight. These are the benefits our clients highlight:
- Total prevent–detect–respond coverage: Immutable backup, email filtering, WAF, EDR/XDR, and UTM perimeter security in a single managed contract.
- Ensured continuity: Regain full control of your infrastructure in the event of a cyber incident in less than 4 hours.
- Zero Trust by design: Identity-based access control and MFA for any user and device.
- AI-powered defence: Machine learning engines that monitor endpoints and networks in real time and reduce the mean time to detection.
Frequently Asked Questions
- Should the ransom be paid in a ransomware attack?
- Paying does not guarantee the data will stay unpublished or that decryption tools will work, and it funds future attacks. The decision rests with management and legal advisers, but the priority should be recovering from verified backups and meeting notification obligations.
- How do we know which data was taken?
- Only through logs. If traces of access, outbound traffic and file server activity are not retained for long enough, the investigation cannot narrow the scope and the company is forced to assume the worst case.
- How do I know if my company is truly protected?
- With evidence: EDR coverage, two-factor authentication on all remote access, immutable copies, and a recently tested restoration. If any of these four points are not confirmed, there is a real risk of prolonged downtime.
- Where should a company wanting to address cybersecurity begin?
- With an audit of the current environment. At Seintec, we perform an initial no-cost review that identifies risks, dependencies, and priorities, resulting in a phased plan with fixed deadlines and budgets.
- Is it necessary to halt business operations during the project?
- No. We plan migrations and changes within agreed windows, with prior pilot tests and rollback options, ensuring disruption is minimal or non-existent for users.
- What type of companies do you serve?
- SMEs and mid-market companies in sectors such as industry, automotive, logistics, retail, legal, and healthcare, with both on-premises and hybrid cloud infrastructure.
- What coverage and response times (SLA) do you offer?
- Support from Monday to Friday, 09:00 to 18:00, and 24x7 emergencies 365 days a year, with a committed response SLA and a 99.98% service SLA in 2025.
Ransomware response is prepared before the incident. At Seintec we review your exposure, your backups and your detection capability, and put the crisis procedure in writing. Request a cybersecurity review.
Contact SeintecRelated service
Cybersecurity
We shield your company so it never stops.