Cyberattacks between BSI notification and capital market information
Cyberattacks have long ceased to be merely technical disruptions within IT infrastructure. They can interrupt production processes, affect confidential data, trigger substantial costs and influence a company’s valuation on the capital market. For listed issuers, a significant security incident can therefore simultaneously trigger supervisory notification obligations under the BSI-Gesetz (BSIG, German Federal Office for Information Security Act) and capital markets disclosure obligations under the Marktmissbrauchsverordnung (MAR, EU Market Abuse Regulation).
Since 6 December 2025, the revised BSI-Gesetz has applied. It implements the NIS 2 Directive into German law and significantly expands the group of regulated entities. Particularly important and important entities must report significant security incidents under § 32 BSIG (German Federal Office for Information Security Act) in a staged procedure. For issuers of financial instruments, Art. 17 MAR (EU Market Abuse Regulation) applies in addition if the incident also constitutes inside information.
The two regulatory regimes pursue different objectives. Notification under § 32 BSIG serves official situational awareness and threat prevention. Ad hoc disclosure under Art. 17 MAR protects the proper functioning of the capital market by providing simultaneous information to the investing public. There is no statutory mechanism coordinating the two obligations.
The notification regime under § 32 BSIG
Significant security incident as the trigger
Under § 32 BSIG, particularly important and important entities are subject to notification obligations if a significant security incident has occurred. An incident is significant in particular if it has caused, or is capable of causing, serious operational disruption or financial losses. It also covers situations in which other natural or legal persons are, or may be, affected by significant material or immaterial damage.
This threshold is not identical to price relevance under capital markets law. An incident that is notifiable under § 32 BSIG is not automatically inside information. Conversely, relevance as inside information under capital markets law may already exist before the supervisory significance has been finally established.
The Bundestag (German Federal Parliament) adopted the NIS 2 Implementation Act on 13 November 2025. It was promulgated in the Bundesgesetzblatt (Federal Law Gazette) on 5 December 2025. According to the legislative materials, the group of entities covered was estimated at around 29,500; in some cases, higher figures were also mentioned.
Deadlines and notification stages under § 32 BSIG
§ 32 BSIG provides for a staged notification cascade. Under § 32 Abs. 1 Satz 2 BSIG (Section 32(1) sentence 2 BSIG), the notification obligation applies no earlier than the establishment of the notification channel. The BSI portal for registration and notifications was activated on 6 January 2026 and thus put into operation around one month after the Act entered into force.
The main stages are:
- an early warning within 24 hours of becoming aware of the significant security incident,
- a notification within 72 hours with an initial assessment of severity and impact and, where available, indicators of compromise,
- interim reports at the request of the BSI,
- a final report no later than one month after the 72-hour notification.
Notifications are submitted to a joint reporting office of the Bundesamt für Sicherheit in der Informationstechnik (BSI, German Federal Office for Information Security) and the Bundesamt für Bevölkerungsschutz und Katastrophenhilfe (BBK, German Federal Office of Civil Protection and Disaster Assistance). This is therefore an official reporting procedure, not a market disclosure.
Registration status and sanctions
The number of registered entities initially fell short of expectations. As of the June 2026 reporting date, 17,729 companies were registered in the BSI portal, including 11,501 important and 6,215 particularly important entities. By 30 September 2026, the number had risen to 20,141 entities according to official BSI statistics, including 13,252 important and 6,837 particularly important entities.
Breaches of notification obligations may be subject to administrative fines under § 65 BSIG (German Federal Office for Information Security Act). For particularly important entities, § 65 BSIG provides for fines of up to EUR 10 million or up to 2 per cent of total worldwide turnover. For important entities, the range is up to EUR 7 million or up to 1.4 per cent of total worldwide turnover.
Cyber incident as inside information under Art. 7 MAR
Precise information despite incomplete clarification
Inside information within the meaning of Art. 7 MAR requires precise information that is not publicly known and that is likely to have a significant effect on the price of a financial instrument. The benchmark is the perspective of a reasonable investor. In cyber incidents, operational interruptions, data exfiltration, potential fines, extortion demands and reputational damage may in particular be price-sensitive.
The fact that, in the early phase of an attack, it is often still unclear how extensive the damage actually is does not automatically preclude precision. According to the case law of the Europäischer Gerichtshof (ECJ, Court of Justice of the European Union) and the Bundesgerichtshof (BGH, Federal Court of Justice), intermediate steps in a protracted process may also constitute independent items of inside information. The decisive factor remains whether the known facts are already sufficiently specific and may be of considerable significance from the market’s perspective.
In the case of a cyberattack, the confirmed finding that attackers had access to systems and that the extent is still unclear may therefore already be relevant under capital markets law. A fully completed forensic investigation is not always a prerequisite for classification as inside information.
Recast of Art. 17 MAR by the Listing Act
As of 5 June 2026, Art. 17 MAR and, in particular, the rules on ad hoc disclosure were amended by the EU Listing Act. Intermediate steps in protracted processes are, in principle, no longer subject to ad hoc disclosure; under the revised version, it is generally the final event that must be disclosed. The status of such intermediate steps as inside information must be distinguished from this.
This amendment does not generally relieve cyber incidents in the same way as classic multi-stage decision-making or transaction processes. A cyberattack has often already occurred; only its extent is clarified step by step. The progress of IT forensic findings is therefore not automatically an intermediate step in a process aimed at a later final event within the meaning of the new rules.
Immediate disclosure under Art. 17 MAR
Art. 17(1) MAR requires inside information to be disclosed as soon as possible. Waiting until the technical investigation has been fully completed is therefore generally incompatible with this requirement if the known circumstances already constitute inside information. Only the period required for an orderly review, assessment and decision-making process remains permissible.
In 2026, BaFin (German Federal Financial Supervisory Authority) made clear that cyber incidents may also be the subject of capital markets sanctions. On 16 July 2026, it imposed a fine of EUR 240,000 on a software company it named, because, in the authority’s view, the company had failed to disclose without delay, as inside information, the fact that it had become the victim of a cyberattack. BaFin expressly based the inside-information nature of the incident also on the fact that the company was a software company.
According to media reports, the trigger was a cyberattack in June 2024 that the company attributed to a Russian hacker group. According to the company, neither the communications platform nor the product environment nor customer data were affected. According to the Börsen-Zeitung, the company had announced the attack on its own website, but not by way of an ad hoc announcement; a company spokesperson stated that the company had taken note of BaFin’s assessment. According to reports, the range of fines could have been up to EUR 2.5 million or up to 2 per cent of total turnover.
Delay of disclosure in the cyber context
Legitimate interests under Art. 17(4) MAR
Art. 17(4) MAR permits the delay of disclosure of inside information subject to certain conditions. In particular, immediate disclosure must be likely to prejudice the issuer’s legitimate interests, the information must not contradict earlier public announcements or other communications by the issuer on the same matter, and confidentiality must be ensured. The former prohibition on misleading the public was replaced by the Listing Act with a more specific prohibition on contradiction.
In connection with cyberattacks, legitimate interests may be affected, for example, if the ongoing containment of an attack would be jeopardised by immediate disclosure. Risks of copycat attacks if an exploited vulnerability is disclosed, ongoing contacts with the perpetrators or official investigative interests may also be relevant. However, these considerations do not replace the examination of the further conditions under Art. 17(4) MAR.
Prohibition on contradiction and previous market communications
The prohibition on contradiction may become particularly relevant if an issuer published statements before the incident that are called into question by the cyberattack. This may concern, for example, confirmed forecasts, statements on business objectives or public statements about the issuer’s own cyber resilience. If the undisclosed inside information contradicts such communications, a delay is precluded already as a matter of the constituent requirements.
Delegated Regulation (EU) 2026/789 provides illustrative clarification of relevant scenarios and forms of communication. Its Annex I contains a non-exhaustive list of 35 final events in seven categories; security incidents are not listed. Cyber scenarios are not listed separately on a conclusive basis.
Confidentiality as a particularly vulnerable condition
Confidentiality is often particularly difficult to safeguard in cyber incidents. In so-called double extortion scenarios, attackers may not only encrypt systems but also threaten to publish stolen data. If data are posted on leak sites or customers, media or other third parties are contacted, confidentiality may cease to exist.
At the latest when a sufficiently precise rumour emerges, immediate disclosure may become necessary under Art. 17(7) MAR. In the cyber context, a delay is therefore structurally uncertain because its continued validity may depend on circumstances outside the issuer’s sphere of influence.
Documentation, BaFin notification and insider list
If disclosure is delayed, the timing, decision-making basis and principal considerations must be recorded. Following subsequent disclosure, BaFin must be informed of the delay. For credit and financial institutions, Art. 17(5) MAR contains a special provision to safeguard financial stability.
Persons who have access to the inside information must be included in the insider list under Art. 18 MAR. This may also concern external IT forensic experts, communications advisers and other persons involved in the incident response. Selective prior disclosure to individual stakeholders is permissible only within the narrow limits of Art. 17(8) MAR.
Coordination issues between § 32 BSIG and Art. 17 MAR
No alignment of deadlines
The 24-hour early warning under § 32 BSIG and the disclosure obligation under Art. 17 MAR do not run in parallel. In individual cases, the ad hoc disclosure obligation may arise before the 24 hours have expired if the price relevance of the incident is evident. Conversely, timely notification to the BSI does not relieve the issuer under capital markets law.
The BSI notification is not a public announcement within the meaning of MAR. It creates neither a sectoral exemption nor a safe harbour for Art. 17 MAR. Likewise, a delay under Art. 17(4) MAR does not suspend the deadlines under § 32 BSIG.
Different content, same facts
The notification to the BSI primarily concerns technical and security-related information. By contrast, the ad hoc announcement focuses on valuation-relevant circumstances for the capital market. Nevertheless, both communication channels concern the same facts.
Contradictions between the factual presentation to the authorities and market communications may trigger significant risks. They may impair the issuer’s credibility and retrospectively call into question the conditions for a delay. Possible notifications under Art. 33 and Art. 34 DSGVO (GDPR, General Data Protection Regulation) may also be added if personal data are affected.
Sanction and liability risks
Breaches may be sanctioned both under the BSI-Gesetz and under capital markets law. In addition to § 65 BSIG, Art. 30 MAR in conjunction with § 120 WpHG (German Securities Trading Act) may be relevant. If ad hoc disclosure is omitted or incorrect, issuer liability risks may also arise under §§ 97, 98 WpHG (German Securities Trading Act).
On 23 June 2026, BaFin imposed fines totalling EUR 620,000 on an industrial company it named. According to the authority’s announcement, this concerned, among other things, inside information that had not been disclosed without delay and a half-yearly financial report for 2024 that had not been published. The case shows that capital markets disclosure practice continues to be closely monitored even outside purely cyber-related scenarios.
By way of comparison, US capital markets law has, since the end of 2023, provided for disclosure of material cyber incidents within four business days after materiality has been determined. For certain foreign issuers, by contrast, a more flexible “promptly” regime applies. European law remains more case-specific with the criterion “as soon as possible”.
Organisational classification for issuers
Incident response and capital market communication
For listed companies, a cyber incident affects not only IT security and crisis response. It may also concern capital market communication, data protection law, supervisory law and management body responsibility. This becomes particularly clear where different obligations affect different legal entities within a group, such as the regulated subsidiary on the one hand and the listed parent company on the other.
In such situations, a robust flow of information is essential. The technical assessment of the incident and its classification under capital markets law must occur in close temporal proximity. Otherwise, there is a risk that notification and disclosure obligations will not be assessed within the respective relevant time window.
Classification of the BSI notification in relation to the ad hoc announcement
§ 32 BSIG and Art. 17 MAR serve different protective purposes. The BSI notification enables the authority to prepare situation reports and respond to security-relevant developments. The ad hoc announcement is intended to make price-sensitive information equally accessible to the capital market.
It does not follow that there is any hierarchy in the sense of one obligation taking precedence over the other. The notification to the authority does not replace market disclosure. Conversely, market disclosure does not replace notification to the joint reporting office of the BSI and the BBK.
Special significance of the sector
The assessment of a cyber incident may depend on the sector of the company concerned. In the proceedings against the software company it named, BaFin expressly justified the inside-information nature of the incident also by reference to its activity as a software company. It cannot be inferred from this that only technology companies may be affected.
Cyber incidents may also be price-sensitive for companies in other sectors. The decisive factors remain the specific effects or potential effects on business operations, financial position, reputation, regulatory risks and market expectations. Significance under § 32 BSIG and price relevance under Art. 7 MAR must continue to be assessed separately.
Frequently asked questions
Is a significant security incident under § 32 BSIG automatically inside information under Art. 7 MAR?
No. The notification obligation under § 32 BSIG and inside information under Art. 7 MAR have different requirements; a notifiable security incident is not necessarily price-sensitive, while relevance as inside information may also exist before final supervisory classification.
Must a cyberattack be disclosed by ad hoc announcement under Art. 17 MAR?
An ad hoc announcement is required if the cyberattack constitutes inside information and there is no effective delay under Art. 17(4) MAR. In 2026, BaFin emphasised in a published fine case that cyber incidents may be subject to disclosure obligations under capital markets law.
What practical consequences do § 32 BSIG and Art. 17 MAR have for listed companies?
Listed companies may have to report the same cyber incident to the BSI while also assessing it under capital markets law. The deadlines, addressees and content of the two obligations differ, so a BSI notification does not replace ad hoc disclosure.
Classification for capital markets law issues
For issuers, cyber incidents may form a complex interface between IT security law, data protection law and capital markets law. § 32 BSIG and Art. 17 MAR stand side by side: notification to the BSI does not constitute disclosure to the market, while an ad hoc announcement does not replace an official security notification. Companies, investors and members of corporate bodies who wish to have capital markets law questions relating to cyber incidents, inside information or ad hoc disclosure assessed can find support from MTR Legal in the area of legal advice in capital markets law.
