Current Status

Cyberattack on Incert

Following the cyberattack on parts of the IT infrastructure used by Incert, investigations and additional security measures continue to be treated as a top priority. Our online systems remain available to our customers and partners. Day-to-day operations are currently unaffected, though our service team is not available to the usual extent due to the ongoing forensic investigations.

Our goal is to fully investigate the circumstances surrounding the incident, minimize any potential impact on our customers and partners, and provide transparent updates on new, verified findings.

If customers contact you with specific information, please forward any suspicious cases to:

privacy@incert.at

Online systems remain available –
Security measures and investigations are ongoing

The online systems for our customers and partners remain available.

Information

What happened?

On the evening of November 5, the unauthorized access was detected by Incert’s internal security monitoring system. The affected server was immediately secured.

A data breach occurred as a result of the attack. The data transmitted was compressed and encrypted by the attackers. Therefore, it is not yet possible to definitively determine exactly which specific data was actually compromised.

A detailed analysis of the data breach is a key component of the ongoing forensic investigations.

Latest Updates

Update: November 10, 2026

Close collaboration with IT security experts

Since the attack came to light, external cybersecurity experts, IT specialists, IT forensic experts, and our professional hosting providers have been working intensively with the Incert crisis response team—in close coordination with the trio of managing directors—to investigate the incident and further secure the systems.

The collaboration focuses in particular on the technical reconstruction of the attack, the analysis of the potential data breach, and the implementation of additional security measures. The online systems for our customers and partners are not affected and remain available.

More Updates

Update from November 7, 2026

On November 7, the customer notice was updated again. The update provided additional information about the attack, particularly regarding unauthorized access to a managed server.

Update as of November 6, 2026

Immediate Notification of Authorities and Customers

As early as November 6, 2026, the incident was reported to the relevant data protection authority, and a criminal complaint was filed with the State Criminal Investigation Office. Also on November 6, all of Incert’s business customers were informed about the security incident and the information available at that time.

From the very beginning, timely, transparent, and open communication with our customers and partners has been our top priority. At the time we first reported the incident, the available information indicated a targeted attack on the databases of two business customers.

Information

Ongoing Updates and Next Steps

We are aware of our responsibility toward our customers and partners.

Investigating the cyberattack and further securing our systems are currently our top priorities. Our internal teams and external specialists are working diligently to minimize any potential impact as much as possible.

We will continue to transparently publish new, verified findings and relevant developments on our website.

We ask for your understanding that, due to this extraordinary situation, there may be temporarily longer response times for personal customer support.

Vouchers that have already been issued remain valid and can be redeemed until further notice. This also applies to newly purchased vouchers.

To the best of our knowledge, there have been no reported cases of fraudulent voucher redemption.

We regret any inconvenience this cyberattack may cause our customers, partners, and their customers, and we are working around the clock to resolve the issue and secure our systems. We thank our customers and partners for their trust and support during this challenging situation.

FAQ

Is my company affected?

The attack was specifically targeted at certain systems, but we cannot rule out the possibility that your system has been affected. If you suspect your system has been compromised, please contact privacy@incert.at directly.

Can I continue using my coupon system?

At this time, there is no evidence of misuse. Nevertheless, we ask our customers to remain vigilant and to report any suspicious activity immediately.

Sind meine Login-Passwörter des incert-Systems betroffen? 

No, login credentials are not affected. Nevertheless, as a precaution, we recommend that customers change relevant passwords immediately.

Is any credit card or payment information affected?

No. Credit card information is definitely not affected by this incident, as we neither process nor store it.

Is this incident related to the well-known PHP2shell issue from October?

No, there is no connection.

Mindfulness in the Workplace

There is currently no evidence that the purchaser data for the gift certificates/tickets is being used for malicious purposes, such as fraud attempts, unusual contact attempts, or phishing activities. In particular, misuse of travel booking information is not expected, as no booking data is processed.

Nevertheless, we ask customers to exercise increased caution if, after purchasing a gift certificate or ticket, they receive unusual contact attempts (e.g., via unknown email addresses, WhatsApp messages—especially from abroad—or by phone) and are asked to take unusual actions, such as entering confidential information or making payments.

What is known about the attackers?

So far, no attacker has come forward. INCERT has not received a ransom note either. There is currently no confirmed information regarding the identity or possible motives of the attackers.

Based on current information, no data was altered, deleted, or encrypted as a result of the attack. This assessment refers to the data in the affected systems and not to the data transmissions encrypted by the attackers.

The forensic investigations are still ongoing.

If customers contact you with specific information, please forward suspicious cases to

privacy@incert.at

Press

Press Release dated November 10, 2026

For inquiries, please contact communications@incert.at

Download the press release