Regional Court of Traunstein: Why a Cyberattack Alone Does Not Trigger a Claim for Damages

A successful cyberattack is a serious event for any company. Beyond the technical recovery, further questions quickly arise: Was personal data stolen? Are claims for damages to be expected? And does a data breach automatically mean that IT security was inadequate?

These are precisely the questions addressed in the judgment of the Regional Court (Landgericht) of Traunstein of 17 July 2026 (Case No. 9 O 1560/24). The decision is particularly relevant for management and those responsible within companies: a hacker attack alone does not prove a violation of the General Data Protection Regulation. What matters instead is whether the company had implemented appropriate security measures before the incident and whether a specifically asserted damage actually results from a data protection violation.

What Was the Case About?

Following a cyberattack, a company’s data had been published on relevant platforms. An affected individual claimed, among other things, non-material damages. He relied on a loss of control over his data and concerns about possible misuse.

The court dismissed the action. In the court’s view, it had not been sufficiently established that the company had breached its data protection obligations. Likewise, there was insufficiently specific evidence that the claimant had suffered compensable damage as a result of this particular incident.

An Attack Does Not Prove Deficient IT Security

One of the most important statements of the judgment is: even good protective measures can be overcome. The GDPR does not require one hundred percent security. Companies must, however, establish a level of protection that matches their specific risks, the data processed and the current state of the art.

Whether the measures were appropriate must be assessed from the perspective prior to the attack. The fact that an attack later proved successful is therefore not sufficient to automatically conclude that a violation occurred.

In short: liability is not determined by the successful attack, but by whether the company adequately managed its risks in advance and can prove this.

What Does This Mean for Damages Claims?

For a claim under the GDPR, merely pointing to a data breach is not enough. Data subjects must generally demonstrate that their own data was affected, that a data protection violation occurred, that they suffered specific material or non-material damage, and that this damage was caused by the violation.

A loss of control may in principle constitute non-material damage. However, general concerns about spam, unwanted calls or identity misuse are not automatically sufficient. Particularly where data was already publicly accessible or may originate from earlier incidents, the link to a specific data breach must be examined especially carefully.

Four Tasks for Management

The decision shows how important robust preparation for cyber incidents is:

1. Assess risks regularly: What data does the company process, how sensitive is it and which attack scenarios are realistic?
2. Document security measures: Technical and organisational measures should not only be in place, but also be comprehensibly described and regularly updated.
3. Record decisions: Why was a particular protective measure chosen? Which alternatives were considered? This documentation may later prove decisive.
4. Prepare for an emergency: Responsibilities, reporting channels, communication and legal review belong in a well-rehearsed incident response process.

Requests and Information Must Also Be Specific

The judgment also contains two practical points: anyone demanding specific security measures from a company must identify them as concretely as possible. The general demand to comply with the “state of the art” is, on its own, too vague.
The right of access also has limits. A company is not required to provide information it does not have and cannot objectively obtain, such as the identity of anonymous attackers. Nevertheless, communication with data subjects should be careful, transparent and comprehensible.

Conclusion

A data breach does not automatically lead to liability under the GDPR. For companies, this is an important clarification. What remains decisive, however, is whether appropriate protective measures were taken, regularly reviewed and properly documented.

The key message for management is therefore: cybersecurity is not a purely technical task. It is part of the company’s organisation and should be managed accordingly. Those who know their risks, assign responsibilities and document decisions comprehensibly improve not only the company’s security, but also its position in the event of a dispute.