The hardest moment in a digital crisis is the very beginning. In the first hours you don't know exactly what happened in the network. Even so, you are morally and legally obliged to communicate something. Two cases from July 2026 illustrate this extremely difficult situation perfectly. The Ministry of European Investments and Projects (MIPE) announced a major problem. On 17 July, their application for beneficiaries was seriously affected. The "Vasile Goldis" University of Arad (UVVG) did exactly the same. They publicly announced a major IT incident on 28 July. Neither institution gave the press absolutely all the technical details. Both nevertheless communicated quickly, and that is our main lesson. Communicating a cyber incident must be done with great responsibility and transparency. Every manager or entrepreneur must learn how to handle this enormous stress.
What happened behind the scenes at these two institutions?
The MIPE application used for procurement procedures suddenly became completely unavailable. The Ministry announced the technical incident and began urgent checks. During the same period, the leadership of DNSC (the Romanian National Cyber Security Directorate) made extremely cautious statements. They specified that the institutions' data did not appear to have been put up for sale. That was a finding of the moment, not an absolute total guarantee. In Arad, the UVVG leadership immediately announced the compromise of its IT infrastructure. The digital services used by students and teachers were seriously affected. The university promptly informed the competent institutions, such as DNSC and DIICOT. The technical teams worked non-stop to limit the spread of any damage. There are no technical details that clearly indicate a ransomware attack. This is a textbook example of how to avoid needless general panic.
What does the timeline of pressure look like in an organisation under attack?
At hour zero, a simple employee notices that an important application is down. Nobody knows whether it is just an error or a malicious attack. In the first hours, the technical team isolates the servers and looks for digital traces. Many questions are born that have no clear answer yet. Management keeps up the pressure and desperately asks: "What do we say publicly?". On the first day, it is usually decided to draft a short press release. This is where the chain of trust frequently breaks in very many companies. Some firms choose to stay silent out of fear until the investigation progresses. Others promise far too much and claim the data is safe. In the following days, the truth comes out and contradicts the first statements. MIPE and UVVG wisely chose the most cautious path possible. They only announced that there is an incident and that they are working on remediation.
| Information you know for sure and share | What you DON'T know and must not claim yet |
|---|---|
| A certain service is unavailable | The exact cause of the problem (internal error or attack). |
| The team is working and the state authorities have been notified | The extent of the damage and the number of systems affected. |
| Temporary alternatives for your customers | The lie that "absolutely no data was stolen". |
Where do most small and medium-sized companies go wrong today?
In the MIPE and UVVG cases, the institutional communication plan worked absolutely perfectly. In the private sector, however, this chain constantly breaks for three reasons. First, companies have no written communication plan in advance. Nobody knows who approves the message and on which channels it is published. As a result, the first day of the crisis is lost entirely in endless internal debates. Second, entrepreneurs confuse public communication with strictly legal notification. Warning customers and notifying the state are things with completely different deadlines. In September 2026, a public institution received an extremely harsh fine. DNSC sanctioned it with 50,000 lei for failing to meet notification deadlines. These obligations are very clearly regulated by the recent European NIS2 legislation. Third, customers get absolutely no alternative while they wait. A business partner needs to know how they will work with you tomorrow. At that moment, they are not interested in who attacked you.
What can you do concretely starting this week?
The difference between a calm approach and general chaos is built in advance. Write today a standard template message made up of just four simple sentences. State what is affected, what alternatives exist and when you estimate a resolution. Establish clearly who will approve and who will always publish this message. That person must be reachable by phone, including at weekends. Check with a lawyer whether your company falls under the legal rules. Note the strict reporting deadlines to the authorities in order to avoid huge fines. Create a short list of secure and functional communication channels. They will help enormously when the main email system goes down. Spend half an hour with the whole team discussing a completely fictional scenario. Ask them directly: "If the main website goes down tomorrow, what do we tell our customers?". For complete preparation, turn at any time to a professional IT audit for companies. We offer modern cybersecurity solutions to protect any business or institution. Our team will assist you with clear procedures in the contact section available online.