Draft · INC-20261104-B10C · Kestrel Systems GmbH (Demo)

Built from the incident record, under headings that follow what the provision asks for. Yours to check, complete and send through the authority's own form or portal; Cyresora files nothing.

1 item to complete — the record does not hold when handling was completed. Each is marked [to complete: …] in the text.

Final report after handling — INC-20261104-B10C — Credential stuffing against the customer support portal

DRAFT: Final report after handling under NIS2 — significant incident
Directive (EU) 2022/2555, Article 23, Article 23(4)(e).
Prepared by Cyresora from incident INC-20261104-B10C. Yours to check and edit before you send it; Cyresora files nothing.

To: BSI (national CSIRT)

1. Reporting organization
Kestrel Systems GmbH (Demo)
Contact: security@kestrel.example

2. Incident
Credential stuffing against the customer support portal
Our reference: INC-20261104-B10C
Became aware: 2026-11-04 10:37:02 UTC (2026-11-04 11:37 CET)
Severity (our assessment): medium

3. Detailed description, including severity and impact (Article 23(4)(d))
Sustained credential-stuffing run against the support portal login. Rate limiting and forced password reset applied; no evidence of successful account takeover.
Severity: medium

4. Type of threat or root cause likely to have triggered it (Article 23(4)(d))
Password reuse by portal users combined with an unthrottled login endpoint.

5. Applied and ongoing mitigation measures (Article 23(4)(d))
Rate limiting deployed.

6. Cross-border impact, where applicable (Article 23(4)(d))
None identified.

7. Handling completed (Article 23(4)(e))
[to complete: when handling was completed]

8. Earlier submissions under this regime
Early warning: submitted 2026-11-05 02:37:02 UTC, their reference BSI-INC-88109
Incident notification: submitted 2026-11-06 23:37:02 UTC, their reference BSI-INC-88109-N

When you have sent it

Record it here with what you actually sent (edit the text above to match). That record stops this stage's clock.

Submitted at (Europe/Berlin)

Channel

Their reference

Draft: Final report after handling

Final report after handling — INC-20261104-B10C — Credential stuffing against the customer support portal

When you have sent it