CJEU C-340/21: A Cyberattack Does Not Prove Innocence (Natsionalna agentsia)
Validated facts
Judgment of 14 Dec 2023. After a hack of the Bulgarian tax authority, the CJEU clarified: A successful hack does not per se prove incapacity, but the company bears the full burden of proving adequate protective measures (TOMs). Justified fear of misuse already qualifies as damage.
In plain language
No excuses: Firms can no longer say 'There was no remedy against these hackers'. In court they must prove gaplessly that their locks met the state of the art.
Security relevance & practical tip
Massively raises liability risk for companies with inadequate IT security.
Primary source / reference
- EuGH Urteil vom 14.12.2023 – C-340/21