TeamViewer: Financial regulator imposes fine after cyber attack

Cyber ​​attack, late communication and a hefty fine: The provider TeamViewer pays 240,000 euros to the financial regulator. The company did not report a massive break-in by Russian hackers in a timely manner via the official stock exchange channels.

Penalty for software providers

The remote maintenance software provider TeamViewer has to pay a fine of 240,000 euros. The reason is a delay in informing the public after a cyber attack in mid-2024. As a listed company, TeamViewer is subject to strict publication obligations for price-relevant events. Such incidents are considered inside information because they can influence the stock price. According to the Market Abuse Regulation, they must be published immediately via a special electronic system. At the end of June 2024, TeamViewer only provided information on its own website. This did not meet the legal requirements.

Background to the cyber attack

As the Bafin a hacker attack on a listed company must be reported. At the end of June 2024, attackers gained access to TeamViewer’s internal IT environment. Conspicuous activities in the network led to the involvement of external specialists. According to information from the security scene, the Russian group APT29, also known as “Cozy Bear”, is suspected to be behind the attack. She is believed to have connections to the Russian foreign intelligence service. Attackers often use stolen credentials to break into networks. According to the company, the product environment and customer data remained untouched. The supervisory authority still viewed the late reporting as a violation. Timely information is crucial for investors.

If a company does not publish inside information immediately, it violates the MAR, specifically Article 17 paragraph 1 subparagraph 1. Bafin can punish this with a fine. This amounts to a maximum of 2.5 million euros or up to two percent of total sales.

Possible legal remedies and penalties

The fine is below the legal maximum amount. For violations of Article 17 of the Market Abuse Regulation, up to 2,500,000 euros or up to two percent of annual sales are possible. TeamViewer achieved sales of over 600 million euros in 2023. This would result in a theoretical maximum value of around twelve million euros. The company can appeal the decision.