When is an IT hack considered legal force majeure?
The court has officially ruled that the notorious Citrix hack at the Public Prosecution Service (OM) was a situation of force majeure.
This decision is based on the fact that it involved an unknown zero-day vulnerability that lay entirely outside the organization’s influence and sphere of risk.
A crucial element in this ruling was that no security update was yet available for this specific vulnerability, whereas the Public Prosecution Service had installed all previous updates in a timely manner.
During the incident, completely disconnecting from the internet was a necessary measure to prevent further access to highly sensitive information.
The court ruled that the attack could not reasonably have been foreseen or prevented, and that the Public Prosecution Service worked urgently and in coordination with chain partners on a phased recovery.
An important lesson for organizations: an IT hack is not automatically considered force majeure from a legal perspective. Demonstrable preparation, prevention, the necessity of intervention, and adequate recovery weigh heavily in the final judgment.
Read the uitspraken.rechtspraak.nl article for more information.