Rail freight ransomware: significant-incident judgement and the arithmetic of the reporting clock
Baltic Rail Cargo SIA is a Latvian rail freight undertaking with 640 employees and is an essential entity under the national transposition. On Monday 3 March 2025 at 03:40 the on-call engineer found that the wagon-tracking dashboard had stopped updating and that a ransom note was displayed on the dispatch server console. At 06:10 the IT team isolated the dispatch VLAN. At 09:00 the commercial director told a journalist that services were unaffected. In fact, wagon handovers at two border yards had been handled on paper since 04:15, with average delays of six hours, and three customers had filed complaints. At 11:30 on 3 March the incident response retainer concluded that initial access was a phishing email opened on 21 February and that data had been exfiltrated from the customer billing share. At 16:20 on Tuesday 4 March forensics confirmed that the backup catalogue had also been encrypted. The company holds a CSIRT contact list but has never filed a notification of any kind.
1. Determine whether this is a significant incident and state the reasoning. Then answer the CEO's question: do we have to report, and when does the clock start?
Read the worked answer
Significance. The Art. 23(1) trigger is a significant incident, which turns on severe operational disruption of the provision of services, or financial loss, or an effect on other persons capable of causing considerable material or non-material damage. The test includes incidents capable of causing such effects - you do not wait for confirmed damage.
Here the facts are unambiguous: four and a half hours of manual border handovers, six-hour average delays, formal customer complaints, and exfiltration from the billing share containing customer data. Severity is judged against the service, not against the IT system, so the fact that the dashboard failure looked like a monitoring problem is irrelevant. The director's public statement that services were unaffected does not change the assessment - and it is now itself a risk.
The clock. It starts when the entity has a reasonable degree of certainty that a significant incident has occurred. It does not start at root-cause certainty. Arguing conservatively, awareness existed at 03:40 on Monday 3 March; the latest defensible point is 06:10, when the VLAN was isolated, which confirms the organisation knew this was a real incident.
Therefore: early warning was due within 24 hours, i.e. by 03:40 on Tuesday 4 March (at the latest 06:10). It is now overdue. Incident notification is due within 72 hours of awareness, i.e. by 03:40 on Thursday 6 March (latest 06:10). The one-month final report runs from the incident notification.
Action. File the early warning immediately with the Latvian CSIRT, state plainly that it is late and why, and do not wait for the forensic report. Late and honest beats late and silent.
2. Draft the content of the early warning and the incident notification, and explain what each stage does and does not require. Address the effect of the 4 March finding about the backups.
Read the worked answer
Early warning (24 hours). Its purpose is to alert the CSIRT while response is still possible, so it is deliberately thin:
- suspicion of a malicious cause - yes, ransomware with a ransom note and confirmed phishing entry;
- any cross-border impact - yes, if the affected border yards handle handovers with operators in another Member State, say so;
- initial information on the incident: affected service (wagon tracking, dispatch, border handover), what has been isolated, and a named contact who can be reached at any hour.
It does not require root cause, exfiltration extent, or a remediation plan.
Incident notification (72 hours). This is the substantive assessment: severity and impact on the service, indicators of compromise (the phishing sender infrastructure, the ransom note hash, the encryption binary), an initial assessment of the malicious cause, and measures taken or planned. It also does not require the investigation to be closed.
Final report (one month after the notification). Root cause, applied and ongoing mitigations, cross-border impact, and, where the incident was malicious, the type of threat or root cause likely used.
Effect of the 4 March backup finding. It does not change any deadline; deadlines run from awareness, not from the last discovery. It does change the severity assessment and must be communicated as an update, because loss of backup recoverability converts a disruption into a recovery-risk event. Expect the CSIRT to request an intermediate report; respond within the time it sets.
Two things not to miss. If personal data is involved, the GDPR 72-hour duty to the data protection authority runs in parallel and the NIS 2 notification is not a substitute. The entity may also notify significant cyber threats voluntarily, which is useful for the phishing wave targeting the sector.
3. The commercial director wants the public statement left uncorrected to avoid 'feeding the story'. Advise on this, on who owns external communication during an incident, and on what the supervisor will make of the discrepancy.
Read the worked answer
Why leaving it is the worse option. The statement is factually wrong in the one dimension that matters: the service was degraded, with documented delays and customer complaints. Three separate audiences can now discover that. A regulator comparing the public statement with the notification filed under Art. 23 will see a contradiction created by the entity, and that contradiction is itself a governance finding under Art. 20, quite apart from any market-conduct or misleading-statement exposure that may apply to the company.
Who owns communication. One named incident-communication owner, reporting to the incident manager, with a single approved holding statement and a log of every external statement and its author. Technical staff do not speak; the commercial function does not improvise. The statement must be consistent, to the word, with what is filed with the CSIRT - that consistency is the evidence that the management body is actually overseeing the response.
How to correct it. Do not issue a bare retraction. Issue an update that acknowledges degraded performance at the two border yards from 04:15, states what customers should expect, and gives the next update time. Correcting a factual error early is treated as competence; being caught by a customer complaint or a journalist is treated as concealment.
What the supervisor will make of it. For an essential entity under proactive supervision, the incident register and its correspondence with public statements is a standard audit item. The supervisor cannot waive the fine for a bad press line, but it can and does read a documented, self-corrected response very differently from a pattern of minimisation.