On November 30, 2025, around 11.30 PM, a third party unlawfully accessed SICO IT servers, through a ransomware attack. One of our employees immediately identified this security incident. Following this, a task force was immediately formed with internal and external experts to further investigate the exact nature of the security incident and estimate the impact, to the extent possible. The IT experts involved took all the necessary measures the same day to prevent and/or mitigate (further) breaches of security measures.
The personal data involved is limited to contact information, and identifiable information of employees, customers and business partners, which does not qualify as sensitive information under applicable privacy laws and regulations, such as the EU General Data Protection Regulation 2016/679. The information that may have leaked were the name and first name, e-mail address, address, phone number and in some cases bank account number and IBAN.
After discovering the source of the security breach, SICO immediately took all measures to prevent external access, such as restricting unauthorized access, improving intrusion detection system, increased monitoring, and others.
Naturally, we are taking additional steps both internally and in cooperation with our external experts to further improve our security measures.
In accordance with the applicable privacy laws and regulations, we as a data controller made the decision to report the incident to the national data protection authority in Czech Republic. In addition to that, we lodge a criminal complain to the competent public authorities.
We encourage you to be extra vigilant for unusual or suspicious activity such as phishing emails or communications sent to you requiring you to share personal data and or certain information.
Should you need to receive support or advice, please feel free reaching out to us at the following address privacy@statech.cz.