Draft · INC-20261104-B10C · Kestrel Systems GmbH (Demo)

Built from the incident record, under headings that follow what the provision asks for. Yours to check, complete and send through the authority's own form or portal; Cyresora files nothing.

Final report — INC-20261104-B10C — Credential stuffing against the customer support portal

DRAFT: Final report under NIS2 — significant incident
Directive (EU) 2022/2555, Article 23, Article 23(4)(d).
Prepared by Cyresora from incident INC-20261104-B10C. Yours to check and edit before you send it; Cyresora files nothing.

To: BSI (national CSIRT)

1. Reporting organization
Kestrel Systems GmbH (Demo)
Contact: security@kestrel.example

2. Incident
Credential stuffing against the customer support portal
Our reference: INC-20261104-B10C
Became aware: 2026-11-04 10:37:02 UTC (2026-11-04 11:37 CET)
Severity (our assessment): medium

3. Detailed description, including severity and impact (Article 23(4)(d))
Sustained credential-stuffing run against the support portal login. Rate limiting and forced password reset applied; no evidence of successful account takeover.
Severity: medium

4. Type of threat or root cause likely to have triggered it (Article 23(4)(d))
Password reuse by portal users combined with an unthrottled login endpoint.

5. Applied and ongoing mitigation measures (Article 23(4)(d))
Rate limiting deployed.

6. Cross-border impact, where applicable (Article 23(4)(d))
None identified.

7. Earlier submissions under this regime
Early warning: submitted 2026-11-05 02:37:02 UTC, their reference BSI-INC-88109
Incident notification: submitted 2026-11-06 23:37:02 UTC, their reference BSI-INC-88109-N

When you have sent it

Record it here with what you actually sent (edit the text above to match). That record stops this stage's clock.

Submitted at (Europe/Berlin)

Channel

Their reference

Draft: Final report

Final report — INC-20261104-B10C — Credential stuffing against the customer support portal

When you have sent it