CJEU C-340/21: A Cyberattack Does Not Prove Innocence (Natsionalna agentsia)
Faits validés
Judgment of 14 Dec 2023. After a hack of the Bulgarian tax authority, the CJEU clarified: A successful hack does not per se prove incapacity, but the company bears the full burden of proving adequate protective measures (TOMs). Justified fear of misuse already qualifies as damage.
En termes simples
No excuses: Firms can no longer say 'There was no remedy against these hackers'. In court they must prove gaplessly that their locks met the state of the art.
Pertinence sécurité & conseil pratique
Massively raises liability risk for companies with inadequate IT security.
Source primaire / référence
- EuGH Urteil vom 14.12.2023 – C-340/21