# The first 24 to 72 hours after a cyber incident or fraud URL: https://insurancelawestonia.ee/specialty-lines/handbook/first-24-72-hours/ Author: Dr Olavi-Jüri Luik, Partner, Head of Insurance Law, attorney at law (Advokaadibüroo WIDEN OÜ) Last updated: 2026-11-06 > Crisis management in the first hours: containment, the crisis team, whom to involve, NIS2, GDPR and insurance law deadlines and policy conditions. > **In short.** The first 24 to 72 hours are decisive for the extent of the loss, the preservation of evidence and insurance cover. The first step is to identify and isolate the incident, the second to activate the crisis team and the third to document all decisions. A forensic partner, a lawyer, the insurer or broker and a communications specialist must be involved. The management board must not confine itself to watching.[^1] A short practical checklist is available in the [Estonian guide to the first 72 hours](https://kindlustusoigus.ee/juhend-72-tundi/). For cyber and crime insurers and breach coaches, this chapter sets out what the insured is expected to do in the first hours and how those steps map onto the statutory and policy deadlines. ## 1. What to do immediately? ### Identify and isolate - Stop the spread of the attack: disconnect infected systems from the network, block compromised accounts, change the passwords of privileged accounts. - Preserve logs and evidence: firewall, e-mail server, domain controller, audit logs of cloud services. - Do not "clean" systems before the investigation. Do not switch off servers that have been safely isolated unless the forensic partner has advised this: memory-based evidence disappears. If isolation is not possible and the infection is spreading, switch the affected device off nonetheless, document the decision and involve a specialist; preserving evidence must not prevent necessary containment. Every technical step can affect later proof. If logs are deleted or systems are changed without documentation, both the analysis of the attack and the presentation of the insurance claim become more difficult. **Example.** A company discovers that its systems have been encrypted. The IT department immediately starts restoring them and deletes some of the logs. Later it proves impossible to establish the origin of the attack or whether data were exfiltrated. The insurer disputes the extent of the loss and compliance with the notification duties. This is avoidable if the initial response is structured. ### In case of fraud: stopping the money If the incident involves a payment to the wrong account, the first hours are critical for freezing the money: - call your bank immediately and ask for a recall of the payment and for the recipient bank to be notified; - stop all similar payments and check recent changes to bank details; - file a criminal complaint with the police (fraud, computer-related fraud, embezzlement: Penal Code (*karistusseadustik*, KarS) § 209, § 213, § 201);[^2] - assess with a lawyer whether to apply for interim measures (securing of the action, *hagi tagamine*). ### Activate the crisis team The crisis team includes: - the management board, or at least one board member with decision-making authority; - the head of IT and information security; - the chief financial officer; - legal counsel; - the head of communications. Appoint a deputy for each role and record who decides on shutting down systems, on a ransom (none is paid without a legal assessment and the insurer's assessment), on public announcements and on notifying the insurer. ### Document All actions, from shutting down systems to communicating with customers, are recorded in writing together with the time. The crisis log will later be evidence both in the insurance claim and in a D&O dispute. ### Qualify early Already in the first hours it must be assessed whether this may be a cyber incident, fraud (crime risk) or a situation that may lead to liability of the board (D&O risk). This determines which insurance contracts may respond and which deadlines must be observed. ## 2. Whom to involve? **Forensic partner.** A specialist who can establish the nature of the attack, assess its extent and preserve the evidence. Many cyber policies require the use of service providers approved by the insurer, or cover the costs of other providers only by agreement. If the company acts on its own and engages an unsuitable partner, this may affect the indemnity. Most cyber policies have a round-the-clock incident hotline: its number must be in the crisis plan. **Lawyer.** The lawyer's role begins immediately. The lawyer assesses the statutory notification duties, ensures that actions do not harm the company's legal position, steers communication with the insurer and, where necessary, protects the personal interests of the board members. **Insurer or broker.** Most policies require immediate notification. If the company delays, the insurer may argue that the delay increased the loss or prevented the circumstances from being established. **Example.** A company discovers a fraud but tries to deal with it itself and notifies the insurer a week later. The insurer argues that the delay prevented the money from being frozen and the loss from being mitigated. Under Estonian law, late notification does not automatically lead to complete release; what matters is whether and how the breach affected the establishment of the insured event or of the loss and the extent of the insurer's performance obligation (Law of Obligations Act (*võlaõigusseadus*, VÕS) § 452 lg 2).[^3] The dispute is nevertheless costly and avoidable. **Communications specialist.** Wrong or late communication deepens reputational harm, increases the regulatory risk and may lead to further claims (see [crisis communications](https://insurancelawestonia.ee/specialty-lines/handbook/crisis-communications)). **Management board.** The board must take the strategic decisions, secure the resources and coordinate the crisis team. It will later be assessed whether the board performed its duties (Commercial Code (*äriseadustik*, ÄS) § 187).[^4] Within the scope of the Cybersecurity Act (*küberturvalisuse seadus*, KüTS), the board member designated under KüTS § 6¹ is responsible for approving the security measures and overseeing their implementation.[^5] ## 3. Statutory deadlines The table uses the following abbreviations: RIA is the Information System Authority (*Riigi Infosüsteemi Amet*), which receives notifications under the KüTS; the Data Protection Inspectorate (*Andmekaitse Inspektsioon*) is the supervisory authority under the General Data Protection Regulation (GDPR). | Deadline | Obligation | Source | |---|---|---| | Without delay | Notification to the insurer of the insured event | VÕS § 448 lg 1[^6] | | 24 hours | Initial notification to RIA of a cyber incident with a significant impact (within the scope of the KüTS), counted from becoming aware of it | KüTS § 8 lg 1[^7] | | 72 hours | Incident notification to RIA (24 hours for trust service providers) | KüTS § 8 lg 4¹–4²[^7] | | Without undue delay and, where feasible, within 72 hours of becoming aware | Notification by the controller to the Data Protection Inspectorate of a personal data breach, unless the breach is unlikely to result in a risk to individuals; a processor notifies the controller without undue delay; every breach is documented, including those not notified | GDPR art 33(1), (2), (5)[^8] | | 1 week | Notification to the liability insurer of a third-party claim or of circumstances that may lead to an insured event | VÕS § 514 lg 1[^6] | | 1 month from the incident notification | Final report to RIA (obliged service provider); if the incident has not been resolved, the report is treated as an interim report and a new final report is submitted within 1 month of resolution; on RIA's request, an interim report before that | KüTS § 8 lg 4³ and 7[^7] | | Under the policy | Proof of loss in crime insurance; a separate notice under each policy | Insurance contract | The duty to inform data subjects where there is a high risk also arises from the GDPR ([art 34](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679)); whether it applies must be assessed together with a data protection lawyer. ## 4. The insurance perspective The first hours are also critical for insurance cover. Policies usually contain: - a requirement of immediate notification; - a duty to cooperate and to provide information; - a requirement to use approved service providers; - a duty to mitigate the loss. The law obliges the policyholder, upon an insured event, to try as far as possible to prevent and reduce the loss and to follow the insurer's instructions; the insurer reimburses the reasonable costs incurred for this purpose (VÕS § 488, § 491).[^6] Before the loss has been established, the damaged property may not be altered without the insurer's consent in a way that makes it harder or impossible to establish the cause or the extent of the loss, except where the change is necessary to reduce the loss or is in the public interest (VÕS § 488 lg 2). In parallel, it must be assessed which policies may be relevant: cyber insurance covers the technical costs and business interruption, crime insurance the monetary loss and D&O insurance the claims made against the board. Each must be notified separately and with consistent content (see [notification and claims strategy across several policies](https://insurancelawestonia.ee/specialty-lines/handbook/notification-across-policies)). ## 5. Typical mistakes - underestimating the incident and delaying the response; - destroying, damaging or altering evidence; - notifying the insurer late; - using the wrong service provider; - no communication, or failed communication; - communicating with the attacker or paying a ransom without a legal assessment (sanctions risk). These are not technical errors but management errors. That is why crisis management is directly linked to the D&O risk. ## 6. Minimum content of a crisis plan A crisis plan need not be thick. What matters is that it exists outside the company's systems (on paper or on a separate device), because in a ransomware attack the file server may not be available. Minimum content: 1. the members of the crisis team, their deputies and contact details (including personal phone numbers); 2. decision-making authority: who decides on shutting down systems, on public statements and on notifying the insurer; 3. insurance contracts: policy numbers, the insurers' claims contacts, the cyber incident hotline, the broker's contact details; 4. external partners: forensics, lawyer, communications, bank; 5. statutory notification duties and deadlines; 6. a list of critical systems and the order of restoration; 7. message templates for customers, employees and the media. ## 7. Hour-by-hour timeline | Time | Action | Responsible | |---|---|---| | 0–1 h | Identifying the incident, isolation, convening the crisis team | Head of IT, management board | | 1–4 h | Involving the forensic partner and the lawyer; the insurer's incident hotline; in case of fraud, the bank and the recall of the payment | Management board, CFO | | 4–24 h | Preliminary assessment of the extent; initial notification to RIA (if the KüTS applies); written notice to the insurers; criminal complaint | Lawyer, head of IT | | 24–48 h | Assessment of the personal data breach; communications plan; start of the business interruption calculation | Lawyer, communications, CFO | | 48–72 h | Incident notification to RIA (if the KüTS applies); notification to the Data Protection Inspectorate if not already made (the GDPR requires notification without undue delay, so 72 hours is an outer limit where feasible, not a waiting period); notifying partners; restoration plan | Lawyer, management board | | After 72 h | Structuring the claim; notifying the liability insurer of third-party claims (within 1 week) | Lawyer, CFO | | Up to 1 month from the incident notification | Final report to RIA (within the scope of the KüTS); if the incident is unresolved, the report is treated as an interim report and a new final report is submitted within 1 month of resolution | Lawyer, head of IT | The timeline is indicative; the actual deadlines depend on when the company became aware of the event and on the policy terms. ## Related pages - [Evidence and forensics](https://insurancelawestonia.ee/specialty-lines/handbook/evidence-and-forensics) - [Crisis communications](https://insurancelawestonia.ee/specialty-lines/handbook/crisis-communications) - [Notification and claims strategy across several policies](https://insurancelawestonia.ee/specialty-lines/handbook/notification-across-policies) - [Esimesed 72 tundi pärast kahju](https://kindlustusoigus.ee/juhend-72-tundi/) (the first 72 hours after a loss, in Estonian) - [Kriisisimulatsioonid](https://kindlustusoigus.ee/riskijuhtimine/simulatsioonid/) (crisis simulations, in Estonian) ## References [^1]: O.-J. Luik. Ettevõtte juhtkonna riskiraamat [A risk handbook for company management]. Manuscript, as of 03.05.2026, ch 31. [^2]: Penal Code (karistusseadustik, KarS) § 201, § 209, § 213. RT I, 09.07.2026, 28 (in force 01.10.2026). Estonian: ; English: . [^3]: Law of Obligations Act (võlaõigusseadus, VÕS) § 452 lg 2. RT I, 20.06.2026, 18 (in force 01.09.2026). Estonian: ; English: ; RKTKo 05.04.2006, 3-2-1-17-06, p 10–11. . [^4]: Commercial Code (äriseadustik, ÄS) § 187. RT I, 06.07.2023, 131 (in force 01.03.2024). Estonian: ; English: . [^5]: Cybersecurity Act (küberturvalisuse seadus, KüTS) § 6¹. RT I, 06.10.2026, 2 (in force 16.10.2026). Estonian: ; English (version in force 01.10.2026–15.10.2026): . [^6]: VÕS § 448 lg 1–2, § 488 lg 1–3, § 491, § 514 lg 1, 3 (n 3). [^7]: KüTS § 8 lg 1, 4¹–4³ and 7 (n 5). [^8]: Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation), art 33(1). OJ L 119, 04.05.2016, p 1–88. .