Our Company Has Been Hit by a Ransomware Attack: First Response and Legal Obligations

Last updated: 02.11.2026 · Author: Attorney Coşkun Genç, Istanbul cybercrime lawyer

A ransomware attack is a cyber incident that encrypts a company's files and renders them inaccessible, and in many cases also copies the data and threatens to publish it. This article covers incident management, the preservation of records, notifications, communication with service providers and the risks of the decision to pay the ransom; general KVKK compliance processes are outside its scope.

What should be done in the first hours of a ransomware attack?

In the first hours, the aim is to preserve evidence while stopping the spread. Rebuilding the system immediately speeds things up but erases the traces of the attack; technical and legal decisions should therefore be taken together.

1. Isolate, do not shut down: Disconnect the affected devices from the network and the internet. Since cutting the power may destroy traces in memory, let the technical team decide on shutting down.
2. Start the incident log: Record the moment the attack was first noticed, who noticed it and every action taken, with the time. The 72-hour period for notification under the KVKK starts from the moment the breach is discovered.
3. Freeze the evidence: Have the log records, the ransom note, correspondence with the attacker and a forensic image of the affected disks taken; have the hash values of the images recorded.
4. Determine the scope: Which systems were encrypted, was data exfiltrated, were personal data or special categories of personal data affected?
5. Set the notification timetable: Designate a responsible person and a time for the notifications to the Personal Data Protection Board, the data subjects and the Cyber Security Directorate, and for the criminal complaint.
6. Alert the service providers: Request in writing that cloud, hosting, IT support and software providers preserve their own records.
7. Do not rush into payment: Communication with the attacker and the decision to pay should not be made without a legal assessment and without being documented by a management decision.
8. Recover after the evidence: Restoration from backup should begin after the images have been taken and the records preserved; check the integrity of backups kept off the network.

How are log records and digital evidence preserved?

Records are preserved in a manner that allows it to be proven that they have not been altered: first a bit-for-bit forensic image is taken, its hash value is calculated, and the examination is carried out on the copy. Log records show both how the attack took place and which measures the company had taken. Loss of records not only makes the criminal investigation more difficult but may also produce consequences against the company in a KVKK review.

In a review concerning a ransomware attack, the Personal Data Protection Board assessed the failure to provide information on the source of the attack and the inability to access the encrypted log records as a deficiency in data security:

"Considering that the data controller did not submit information/documents to our Authority as to what the security vulnerability that caused the data breach was (despite information having been requested from it on this matter), and that the log records which could contain important information on this matter could not be accessed either (it having been stated that they were encrypted), it was observed that the data controller had deficiencies with regard to the monitoring and control of personal data security"

Personal Data Protection Board, K. 2024/2196, 26.12.2024 (summary of decision)

In the same decision, the fact that two-factor authentication was introduced only after the breach and the inadequacy of network segregation were also regarded as deficiencies, and an administrative fine was imposed under KVKK Art. 18(1)(b). Keeping logs in a separate environment is therefore a legal necessity.

In criminal proceedings, the reliability of digital evidence is assessed according to the same logic. Article 134 CCP governs the search, copying and seizure of computers used by the suspect: provided that there is strong suspicion based on concrete evidence and that evidence cannot be obtained by other means, the decision is taken by the judge or, where delay would be prejudicial, by the public prosecutor; the prosecutor's decision is submitted to the judge for approval within twenty-four hours. During seizure, a backup of all data in the system is taken and a copy of this backup is given to the suspect. The Criminal General Assembly of the Court of Cassation has explained the purpose of this provision as follows:

"With regard to the measure regulated in Article 134 of the CCP, it must be accepted that the purpose of the legislator is to preserve the existing state of digital data that may constitute evidence in criminal proceedings, to eliminate the possibility of interfering with such data before forensic images thereof are taken, and to prevent the suspect from suffering prejudice."

Criminal General Assembly of the Court of Cassation, E. 2016/544, K. 2020/127, 25.02.2020

In this decision, the General Assembly held the data obtained from disks seized without a backup being taken to be unlawfully obtained evidence and reversed the judgment. With respect to the company's own systems, this means that every intervention made after the attack must be recorded. The 12th Criminal Chamber of the Court of Cassation also, in a case allegedly committed over the internet, made the examination of log records by taking forensic images the ground for a reversal for incomplete examination:

"…by taking forensic images of the digital materials pursuant to a search warrant to be duly obtained, […] by examining the log records, after a report has been drawn up in a manner supported by technical data as to whether the account that is the subject of the offence was opened by the defendant […], all the evidence collected being assessed together…"

Court of Cassation, 12th Criminal Chamber, E. 2023/734, K. 2023/3978, 16.10.2023

Records and documents to be preserved

• ✓Firewall, VPN, remote access, e-mail server and authentication (login) logs
• ✓Disk images of the affected servers and computers, their hash values and the imaging record
• ✓The ransom note, the attacker's communication channel, correspondence and the wallet address in the payment demand
• ✓Incident timeline: times of first detection, isolation, notification and recovery
• ✓The personal data processing inventory and a list of the affected data categories
• ✓Documents showing the measures taken before the breach: penetration test reports, backup policy, access authorisation lists
• ✓Service provider contracts and incident correspondence with them

When and how is a data breach notification made under the KVKK?

Where personal data has been obtained by others through unlawful means, the data controller notifies the Personal Data Protection Board without delay and within 72 hours at the latest from the moment it becomes aware of the breach. The legal basis is KVKK Art. 12 and the Board's decision interpreting this provision.

The Board's Decision No. 2019/10 of 24.01.2019 interpreted the expression "within the shortest time" as 72 hours with respect to notification to the Board. According to the same decision, the persons affected by the breach are notified within the shortest reasonable time after they have been identified, directly where their contact address can be reached, and otherwise by appropriate methods such as publication on the website. If the 72 hours are exceeded for a justified reason, the reasons for the delay are explained together with the notification.

The notification is made using the Authority's Personal Data Breach Notification Form (Kişisel Veri İhlal Bildirim Formu). If not all of the information in the form is known at the same time, the information may be completed in stages without delay. In ransomware incidents, whether the data has been exfiltrated is often unclear in the first hours; this uncertainty is a reason to make a staged notification, not to postpone the notification.

The content of the notification to the data subjects is determined by the Board's Decision No. 2019/271 of 18.09.2019. The notification should be made in clear and plain language and should contain, at a minimum, when the breach occurred, which data were affected, distinguishing between personal data and special categories of personal data, the possible consequences, the measures taken or proposed, and contact details.

Compliance with the notification obligation does not, in addition, prevent the data security measures from being examined. The Board accepted that a company hit by a ransomware attack had made its notification within 72 hours and took no action in that respect; however, taking into account that the backup files had also been deleted and that log monitoring was inadequate, it imposed an administrative fine under Art. 12(1) (Board, K. 2020/463, 16.06.2020). In that decision, the Board referred to the statement in the Personal Data Security Guide (Kişisel Veri Güvenliği Rehberi) that backups should be kept off the network.

Is there a notification obligation under the Cyber Security Law?

Yes. Cyber Security Law No. 7545, published in the Official Gazette of 19.03.2025, requires those who provide services, collect or process data by using information systems to notify the cyber incidents they detect to the Cyber Security Directorate (Siber Güvenlik Başkanlığı) without delay. The Law defines a cyber incident as a breach of the confidentiality, integrity or availability of information systems or data (Art. 3(1)(g)); ransomware that encrypts files falls within this definition.

The scope of the Law is broad: Art. 2 covers public institutions and natural and legal persons that are present, carry out activities or provide services in cyberspace. Those who fail to comply with the obligations in subparagraphs (a), (b) and (c) of paragraph 1 of Article 7 of Law No. 7545 are subject, under Art. 16(10), to an administrative fine of from one million Turkish lira up to ten million Turkish lira. Unlike the KVKK, the Law does not set a period in hours; it uses the expression "without delay". The regulations issued by the Directorate should also be followed for the procedure of notification.

The Directorate may provide on-site or remote response support to those exposed to a cyber incident, follows the traces of the attack through log records and shares findings constituting an offence with the judicial authorities (Art. 6(1)(c)). Art. 16(1) provides for imprisonment for those who fail to provide the information, documents and data requested by the Directorate within the scope of its duties; this makes the preservation of records additionally mandatory. Whether sector-specific notification rules exist depending on the field of activity should also be checked.

Which notification is made to whom, and when?

The table below summarises the main notifications that arise in a ransomware incident and their time limits.

How should communication with service providers be conducted?

Communication with service providers should be in writing, dated and aimed at preserving records. Under KVKK Art. 12(2), where personal data are processed by another person on behalf of the company, the data controller is jointly responsible with that person for the data security measures. Cloud, hosting, payroll, accounting and IT support firms are often in this position.

According to the Board's Decision No. 2019/10, if data held by the data processor are obtained by others, the data processor notifies the data controller without delay. Contracts should expressly set out the time limit for this notification, the retention of records and the obligation to cooperate during an incident. If the attack started from the provider's system, the provider should be requested in writing not to delete access records and to take forensic images.

It should also not be forgotten that the provider relationship may itself be a source of risk. In the incident that was the subject of the Board's Decision No. 2020/463, the data controller reported that the attack had been carried out via an IP address belonging to the firm from which it received cyber security support and by an employee of that firm, and that this person was also its own former employee. For this reason, during an incident the authorisations granted to providers should be narrowed, the passwords of shared accounts changed and each access recorded individually.

Attackers may also use the corporate e-mail accounts they have taken over to send fake payment instructions to customers. For this risk, see the article on IBAN change fraud via company e-mail; during the incident, issuing an announcement to customers and suppliers confirming that payment details have not changed should be considered.

Which offences do the attackers commit, and how is a criminal complaint filed?

Depending on the specific case, a ransomware attack may constitute more than one cybercrime at the same time. The criminal complaint is filed in writing with the Chief Public Prosecutor's Office, and the list of preserved evidence, the incident timeline and the ransom note are attached to the petition.

• Unlawful access to an information system (Article 243 TPC): A person who unlawfully enters a system or continues to remain there is liable to imprisonment of up to one year or a judicial fine. If data are destroyed or altered as a result of this act, the penalty is imprisonment of six months to two years.
• Hindering or disrupting the system, rendering data inaccessible (Article 244 TPC): A person who hinders or disrupts the functioning of a system is punished with imprisonment of one to five years, and a person who corrupts, destroys, alters or renders data inaccessible with imprisonment of six months to three years. Where the systems of a bank, credit institution or public institution are concerned, the penalty is increased by one half. Obtaining an unjust benefit through these acts, unless it constitutes another offence, entails imprisonment of two to six years and a judicial fine of up to five thousand days.
• Blackmail (Article 107 TPC): A person who compels another to do something unlawful or which he or she is not obliged to do, or to provide an unjust benefit, is punished with imprisonment of one to three years and a judicial fine of up to five thousand days. Demanding payment under the threat of publishing the data may also be assessed within this scope depending on the specific case.
• Dissemination of leaked data: Article 16(4) of Law No. 7545 provides for imprisonment of three to five years for those who make accessible without authorisation, share or offer for sale personal data located in cyberspace as a result of a data leak. The acquisition of personal data may additionally be assessed under Articles 135–136 TPC.

The Court of Cassation has assessed the obstruction of access to company data under Article 244(2) TPC. In a case in which a former employee was alleged to have prevented the company's access to its data by replacing the disk of the computer he handed over, the Chamber made the following finding:

"…in the incident in which it is alleged that he thereby prevented the company's access to all information and documents within the system, including its banking software, in the examination carried out having regard to the fact that the defendant's act falls within the scope of the offence of ''corrupting, destroying, altering or rendering inaccessible data in an information system'' regulated in Article 244/2 of Law No. 5237…"

Court of Cassation, 11th Criminal Chamber, E. 2021/28211, K. 2025/13592, 22.10.2025

In the same decision, the public prosecution was discontinued because the ordinary statute of limitations for prosecution had expired. This outcome shows the importance of not delaying the criminal complaint and the submission of evidence. Even if the source of the attack is abroad, a criminal complaint ensures that the evidence is officially recorded and paves the way for possible requests for international judicial assistance.

Is paying the ransom legally risky?

There is no general statutory provision that treats a ransom payment as an offence in all cases or permits it in all cases; the risk varies according to whom the payment is made and with what knowledge. The decision should therefore be assessed in light of the circumstances of the incident itself and documented with its reasons.

• Financing of terrorism: Article 4 of Law No. 6415 punishes with imprisonment of five to ten years a person who provides funds to a terrorist or a terrorist organisation with the intention that they be used, or knowing and willing that they will be used, in terrorist offences; where the offence is committed within the framework of the activities of a legal person, security measures specific to legal persons are ordered against the legal person. The offence requires intent; however, since the identity and connections of the attacker are often unknown, this possibility should be separately investigated before payment.
• Asset freezing lists: Under Article 5 of Law No. 6415, Presidential decisions on the freezing of the assets of persons and entities listed by United Nations Security Council resolutions are published in the Official Gazette. Any connection of the payment recipient with these lists should be checked. If the company has connections abroad, foreign sanctions regulations should also be examined separately.
• The obligations continue: Making a payment does not remove the notification under KVKK Art. 12(5), the notification to data subjects or the notification under Law No. 7545. The attacker's statement that it has deleted the data does not change the fact that the data has been obtained by others.
• The outcome is uncertain: Payment provides no legal guarantee that the decryptor will work or that the data will not be published; an undertaking obtained from the attacker carries no sanction.

If payment comes onto the agenda, the decision should be taken by the competent body; the alternatives considered, the checks relating to the recipient and the payment records should be retained.

What are the exceptions and common mistakes?

• The assumption that "no data was stolen, so no notification is required": Reaching this conclusion before it has been established by examination that there was no exfiltration is risky. In its Decision No. 2024/2196, the Board assessed against the company the contradictory statements of a company that stated in its notification that employee and customer data had been affected and later claimed that no personal data at all had been affected.
• Leaving the 72 hours until the technical report is finished: The Board's decision permits staged notification; incomplete information does not stop the clock.
• Formatting the system immediately: A reinstallation carried out before images and logs are taken eliminates the possibility of proving the source of the attack and the company's measures.
• Keeping backups on the same network: The deletion of the backups as well was regarded as a deficiency in data security in the Board's Decision No. 2020/463.
• Unrecorded communication with the attacker: Negotiations conducted from personal accounts and through channels that are not recorded lead both to loss of evidence and to disputes over internal responsibility within the company.
• Untrue statements: Unverified statements about the scope of the incident should not be made to the public or to customers; Article 16(5) of Law No. 7545 separately makes it an offence to disseminate untrue content, intended to create panic, about a data leak known not to have occurred.

Cyber Incident Management with an Istanbul Information Technology Law Lawyer

In ransomware incidents, the course of a matter is often determined by three points: whether log records and images were preserved in the first hours, whether the KVKK and Cyber Security Law notifications were made in time and with consistent content, and whether the payment decision was documented. Av. Coşkun Genç Law Office provides legal assistance in Istanbul to companies experiencing a cyber incident at the stages of preparing notification texts, conducting correspondence with service providers, the criminal complaint and the subsequent KVKK review. In the work carried out as an Istanbul information technology law lawyer, a timeline and an evidence list are drawn up together with the technical team.

Companies wishing to obtain a preliminary assessment with the assistance of an Istanbul cybercrime lawyer may apply with the ransom note, the incident timeline, the initial technical findings, the personal data inventory and the service provider contracts. The office's contact details are available on the contact page. Information on its areas of practice is available on the cybercrimes page.

Sources

1. Personal Data Protection Law (KVKK, Law No. 6698), Art. 12 and 18 – mevzuat.gov.tr
2. Cyber Security Law No. 7545 (Official Gazette 19.03.2025, No. 32846), Art. 2, 3, 6, 7 and 16 – mevzuat.gov.tr
3. Turkish Penal Code (TPC, Law No. 5237), Art. 107, 243 and 244 – mevzuat.gov.tr
4. Code of Criminal Procedure (CCP, Law No. 5271), Art. 134 – mevzuat.gov.tr
5. Law No. 6415 on the Prevention of the Financing of Terrorism, Art. 4 and 5 – mevzuat.gov.tr
6. Personal Data Protection Board, Decision No. 2019/10 of 24.01.2019 (Kişisel Veri İhlali Bildirim Usul ve Esasları [Procedures and Principles of Personal Data Breach Notification]) – kvkk.gov.tr
7. Personal Data Protection Board, Decision No. 2019/271 of 18.09.2019 (minimum elements of the notification to the data subject) – kvkk.gov.tr
8. Personal Data Protection Board, Summary of Decision No. 2020/463 of 16.06.2020 – kvkk.gov.tr
9. Personal Data Protection Board, Summary of Decision No. 2024/2196 of 26.12.2024 – kvkk.gov.tr
10. Criminal General Assembly of the Court of Cassation, E. 2016/544, K. 2020/127, 25.02.2020
11. Court of Cassation, 12th Criminal Chamber, E. 2023/734, K. 2023/3978, 16.10.2023
12. Court of Cassation, 11th Criminal Chamber, E. 2021/28211, K. 2025/13592, 22.10.2025