By Ann Marie van den Hurk, Mind The Gap Advisory
In August, Berlin discovered a cyber incident affecting parts of its state network. Two Senate administrations were isolated. A crisis team was established. Systems were investigated, then reconnected.
That could have been the whole story. It wasn’t.
What happened in Berlin
Investigators later confirmed that data had been exfiltrated from Berlin’s administrative network. The ransomware group Rhysida claimed responsibility, saying it had taken 5.79 terabytes of data across roughly 1.44 million files. Berlin’s government publicly refused to pay the ransom, a position the state made clear in its own statement.
Refusing the ransom did not end the incident. The stolen data was published. Berlin stood up an additional central steering unit under its Chief Digital Officer, bringing together the affected administrations, law enforcement, data protection officials, and information security leadership.
How the incident actually unfolded
Containment. Then confirmed data theft. Then extortion. Then public disclosure. Four distinct problems, arriving one after another, each with its own set of decisions attached, and none of them the problem Berlin started with.
Who decides at each turn? That question doesn’t answer itself just because the technical response is moving fast.
When one incident becomes four
What interests me about Berlin isn’t the ransomware itself. It’s how many times the decision environment had to reset as the incident changed shape.
The first questions were technical. What do we isolate. What has been compromised. Can we contain it, can we restore it safely.
Then the questions changed. Legal questions arrived, about what the stolen data meant and what it required. Notification questions followed. Then communications questions, about citizens and businesses whose information was now sitting in public.
The incident you start with is rarely the incident you end up managing.
Each shift in the incident meant a different set of people needed to be making the call, often faster than anyone had planned for.
The 72 hour question no one had answered in advance
Under the EU’s General Data Protection Regulation, a qualifying data breach must be notified to regulators within 72 hours. That obligation exists independent of whether a ransom is paid. Berlin’s decision not to pay was real and defensible. It simply didn’t answer the notification question. It just meant the notification question had to be answered on its own terms, by whoever actually owns that call inside the organization.
Separately, EU law under the NIS2 directive imposes its own reporting timelines on organizations whose systems touch critical infrastructure, timelines that can run in parallel with GDPR’s rather than replacing them.
Two obligations, potentially two clocks
GDPR and NIS2 can both apply at once, and neither one guarantees the same person is responsible for starting the clock on the other. A regulation that assumes a decision-maker is not the same thing as an organization that has actually named one.
Role, responsibility, authority, accountability
There’s a distinction I use with leadership teams that Berlin illustrates well. Role tells you where someone sits. Responsibility tells you what they manage. Authority tells you what they are actually empowered to decide. Accountability tells you what they ultimately answer for.
Those differences may barely matter on a normal Tuesday. During a cyber crisis, they matter enormously, and they don’t collapse into one person by default, even when a regulator is the one asking who’s in charge.
What this means for your organization
Imagine your security team has contained an incident. Then forensic investigators discover that significant data was stolen. Then the stolen data is published. Then new information appears that changes the risk again.
Can your organization answer, without first negotiating it in a meeting, who owns each consequential decision now? Does that answer change as the incident changes?
If a cyber incident changed shape tomorrow, would your leadership team already know who is authorized to make the next consequential decision?
That is the larger lesson from Berlin. The incident you start with may not be the incident you are managing three hours, three days, or three weeks later. If your organization has to stop and figure out who has authority every time the situation crosses a new threshold, that is a governance gap. Most organizations never find out where that gap sits until they’re already inside the 72 hours.
If you want to find out before an incident forces the question
Governance Gap Map
A 90-minute session that maps where decision authority, escalation, and succession could break under pressure, with a written finding within 48 hours.
Ann Marie van den Hurk, MSc., APR is the founder of Mind The Gap Advisory and originator of the CrisisOS5™ Framework. She advises CISOs, General Counsel, Chief Risk Officers, and boards on decision authority and executive crisis readiness for the AI era. Based in Newport, Rhode Island — serving organizations in Providence, Boston, Portsmouth, Portland, and Hartford, and across New England, nationally, and globally. mindthegapcyber.com