INC-20261104-B10C

Credential stuffing against the customer support portal · medium · aware 2026-11-04 10:13:57 UTC

Report (PDF) Edit

NIS2 — significant incident

Directive (EU) 2022/2555, Article 23
  • Early warningArticle 23(4)(a)
    Submitted
    filed 2026-11-05 02:13:57 UTC

    Within 24 hours of becoming aware of the significant incident.

  • Incident notificationArticle 23(4)(b)
    Submitted falls at a weekend
    filed 2026-11-06 23:13:57 UTC

    Within 72 hours of becoming aware, updating the early warning with an initial assessment.

  • Intermediate reportArticle 23(4)(c)
    Not requested
    — no deadline until they ask

    Only upon the request of the CSIRT or competent authority. No deadline until they ask.

  • Final reportArticle 23(4)(d)
    Running
    in 23d 12h due 2026-12-06 23:13:57 UTC

    Not later than one month after the submission of the incident notification. · Draft it

  • Final report after handlingArticle 23(4)(e)
    Not started
    — starts on the handling being completed

    Where the incident is still ongoing at the one-month point, a progress report is due then and the final report within one month of the handling being completed. · Draft it

Record a notification for NIS2 — significant incident
The real moment it went out. The one-month final-report clock runs from this.

What was actually sent

2
Submitted (UTC)RegimeStageToRef
2026-11-05 02:13 NIS2 early BSI (national CSIRT)Portal BSI-INC-88109
2026-11-06 23:13 NIS2 notify BSI (national CSIRT)Portal BSI-INC-88109-N

Evidence

0 files

Nothing attached. Screenshots of the portal acknowledgment, the sent notification, and the technical analysis live here.

PDF, PNG, JPEG or WebP, up to 10 MB. The file itself has to be one of those — the name is not enough.
×
Live demo — signed in as the admin, sample data resets hourly.
Own it — one payment →