After 24 hours of monitoring, we did not notice any other areas of influence. Incident now closed.

We were able to restart the failed servers without any problems.

According to information from the data centre, it was due to the mains supply, the connection of the UPS took too long - which resulted in the shutdown of some systems. Within seconds, the power flow was back to normal.

We will observe the further course of events for another 24 hours.

We have fixed the whole issue on our network level and on all connected devices.

We have also filed a report with the responsible data protection authority, and after further measures we were unable to detect any misuse of data to third parties.

We have resumed our activities from 08:00 today and apologise for any inconvenience caused.

We will continue to closely monitor all network and email activity for another 72 hours. If no further problems occur, we will close this incident.

The Trojan could not cause any real damage due to the quick reaction of the employee. We were able to remove it very easily from our network layer.

We are now starting the isolation of the network and searching further files / folders and connections to the outside. Currently, we do not assume a data protection-relevant case, but we will still make a report today. The quick capping of the external connection could not harm relevant information.

All connected devices will be searched again from 4 p.m. onwards, provided that no further cases are found - we will confirm this case. However, we will not do any more work today due to the high security risk.

More information in a few hours.

In order to settle any damage, we have stopped the external connection of our office. We have found the cause, it seems to be an email - as requested after a job. After opening the attached documents - despite virus checking - a Trojan seemed to have spread to our network level. After further investigation, we were able to discover the Trojan and are now eliminating it.