CJEU C-340/21: A Cyberattack Does Not Prove Innocence (Natsionalna agentsia)
Hechos validados
Judgment of 14 Dec 2023. After a hack of the Bulgarian tax authority, the CJEU clarified: A successful hack does not per se prove incapacity, but the company bears the full burden of proving adequate protective measures (TOMs). Justified fear of misuse already qualifies as damage.
Explicación sencilla
No excuses: Firms can no longer say 'There was no remedy against these hackers'. In court they must prove gaplessly that their locks met the state of the art.
Relevancia de seguridad y consejo práctico
Massively raises liability risk for companies with inadequate IT security.
Fuente primaria / referencia
- EuGH Urteil vom 14.12.2023 – C-340/21