Starting point
value chain solutions has operated a SaaS data platform for sales and logistics since 2003. Around 20 customers use it every day for reporting, data analysis and automated replenishment. If the platform fails, they lack reports and order proposals in their day-to-day business.
The incident
On a Thursday morning in March 2026, the entire infrastructure was encrypted: the customer platform and all internal systems. Only email via Exchange Online and telephony via VoIP still worked. The internal backups had been encrypted too, but the external ones were complete and accessible at all times, including up-to-date distribution lists of all customers.
The cause
The entry point was an insufficiently protected access account on the firewall. Because internal protection and detection mechanisms were not sufficient, the attacker was able to prepare the attack unnoticed for around six weeks.
My role: leading the crisis team
Within a few hours the crisis team was in place: internal IT, the head of development, an IT security provider, an incident response consultant and, from day 1, a specialist lawyer. I delegated all technical work. Decisions, prioritisation, finance, legal, payment handling and communication stayed with me.
For the first three days the team met twice a day, then daily. Crisis leadership works on a military principle, not by consensus: gather and weigh the experts' input and concerns, decide, instruct clearly.
The hardest decision
Pay or not? The data was safe in the external backup, but the systems were encrypted. A rebuild would have meant a step-by-step restart over 2 to 4 weeks, with an uncertain outcome. The forensic experts rated decrypting ourselves as unlikely and very time-consuming. On day 1, I decided to buy the attackers' decryptor and prepared a fallback plan in parallel, based on the forensic assessment, our financial scenarios and advice from a specialist lawyer.
Communication
A few hours after discovery, an open email went to all customers, followed by an update every working day. I called key customers personally. One customer escalated; more attention calmed things down quickly. No customer left.
Result
First customer services ran after 4 days, full operation after 6 days, with no data loss. After about 12 weeks the systems were back in their pre-attack state, with significantly higher security.
Being prepared
Technical security lowers the likelihood of an attack. Whether a company survives one depends on its preparation:
- Documentation: systems, data, dependencies, restart sequence and contact lists, stored outside your own IT
- Plans: emergency plan without IT, roles and rhythm of the crisis team, decision framework for the payment question, communication templates
- Systems: separated, tested backup, communication outside your own infrastructure, a prepared payment route
- Processes: reporting channels, restart by customer priority, payment approval, regular exercises
- Structures: clear responsibility for outsourced IT security, partners agreed in advance, insurance, protection of shareholder liability
“When the value chain solutions platform was hit by a cyber attack in March 2026, Mr Wabersich led the crisis organisation calmly and in a structured way. Communication with us was open and timely throughout; we knew at every point where the recovery stood. First services were available again after a few days, and full operation was restored after six days, without data loss. We would work with him again at any time and recommend him for situations that call for reliability and clear leadership.”
What I bring
Forensics and IT security solve the technical problem. I take on everything else on the company side: as interim managing director or fractional crisis manager, from day one. And before an emergency, with a readiness check from the management perspective.