Case Studies
The situation was clear. The organization was not.
What began as a temporary administration turned into a restructuring effort. Then came the attack. And with it, a task for which there was no mandate.
Restructuring Environment · IT Turnaround · Crisis Intervention · Restoring Control
Contents
Background
An industrial company with multiple production sites and a complex corporate history. Two segments with different cultures and operational approaches had been brought together under one roof without a coordinated integration process. A period of strong growth masked this tension.
Then the tide turned: an abrupt turnaround, accompanied by personnel changes at the top of the company. Leadership changes and repeated reshuffles in finance and corporate management, coupled with a restructuring carried out under considerable economic pressure. There was no continuity at the executive level. Only one position on the executive board remained filled throughout this period, making it the sole reliable point of continuity.
Mandate
An external IT leadership team was brought in to provide interim management of the base organization—including infrastructure, workplace, and service management—until a permanent successor could be found. The role was clearly defined and independent of existing program structures.
The defined mandate was to restore control over the IT infrastructure. IT security and cyber defense had been explicitly excluded from the mandate. Within the first two weeks, the scope changed. The framework conditions did not.
Initial Assessment and Restructuring Mandate
The first situation assessment was conducted immediately after taking office—a structured evaluation of the existing reality, with a strict separation of facts, assumptions, and opinions, and independent of existing programs or their reporting logic. It was only this separation that created a solid basis for decision-making.
The result made a transitional administration impossible. An external assessment had also recently found the IT organization to be significantly deficient. No action was taken.
The infrastructure was in such poor condition that it could not be managed and required renovation. Although the assessment identified risk areas outside the scope of the contract, no priority was assigned to addressing them.
With the first status report, the administrative assignment was transformed into a restructuring mandate in consultation with the company.
Renovation
Over the course of the first year, the IT infrastructure was established within the contracted scope. Infrastructure, workplace, and service management were once again functional and manageable. There were clear lines of responsibility, effective processes, and a robust reporting system.
An orderly conclusion of the engagement was planned and included in the agreed scope of work.
What was missing: a cyber defense. That was outside the scope of the contract. This distinction will become relevant later on.
An attack as a reality check
A cyberattack affected production across all locations. It targeted an organization whose resilience and IT security had not been part of the mandate.
The initial assessment had identified and documented the unmitigated risk areas. Anything that had not been commissioned had not been addressed.
Second Situation Report
The morning after the attack was detected, the extent of the incident became clear: it was a major cyberattack. There was no consistent operational response capability in place.
Within a few hours of taking over the situation assessment, the second situation report was compiled via conference calls. It was not an update of the first report, but rather an independent assessment based on new circumstances: What had happened so far. What immediate measures were lacking. Why existing structures had failed to enable an operational response. On this basis, initial crisis measures were defined and implemented, including the isolation of IT systems from the Internet.
The second assessment served as the basis for the decision to proceed with the procedure.
Escalation of the situation
An external forensic team arrived on the scene quickly. The evidence was clear: the existing organizational structure and decision-making framework were not capable of responding to this situation. Under these conditions, the forensic work was also structurally hampered. There was a lack of reliable decision-making processes.
As the incident escalated, further intervention became necessary. Just as the remediation itself had already gone beyond the scope of our original contract.
On-site intervention
The missing crisis management structure was established within a single workday. A direct link to the board and a steering committee with defined decision-making authority were convened. Technical crisis teams with clear chains of command were established. Tiered work and access areas with defined access rules were set up. An executive board briefing was held with a clear focus: returning to production as quickly as possible and restoring the in-house value chain.
The intervention involved restoring decision-making capacity where it was no longer present. Decisions were not merely prepared in advance, but were made and implemented. This was done in close coordination with the on-site forensic team and within the existing corporate management structure, with a focus on decision-making capacity and a clear allocation of responsibilities.
From that point on, the forensic work began to bear fruit. The ability to control the process enabled the effective use of technology—not the other way around.
Restoring controllability
The recovery followed a clear phased approach: containment and safeguarding of data integrity, prioritized restart of business-critical systems, stabilization, and a controlled return to normal operations. The restart did not follow the original operational sequence, but rather a prioritized, controllable sequence.
Core systems were restored within a few days. Key production processes resumed approximately three weeks after the attack. Both of these achievements were made while a restructuring effort was underway.
A structural pattern familiar to many companies complicated the process: crisis management teams are staffed based on hierarchy, not on operational expertise relevant to the specific situation. The consequence is structural: business needs—such as mechanisms for restarting production, supply chains, and customer requirements—are addressed only late in the IT system recovery process, even though prioritization has been prepared and planned. As a result, the executive team’s assessment of the situation and the operational reality inevitably diverge.
Handover and Completion
The subsequent phase (stabilization, optimization, modernization) was handed over in an orderly manner. The engagement ended.
What was handed over was a revitalized grassroots organization and a crisis management structure built under real pressure. Both are holding up. Operations were not handed over until these structures were functioning independently.
Transferable Knowledge
A situational assessment is effective only if it is developed independently of existing reporting structures and distinguishes facts from assumptions. Plans are no substitute for decision-making ability. In a crisis, establishing such a structure is a measure in its own right. And crisis committees composed based on hierarchy rather than operational expertise create delays that are technically difficult to make up for.
This is an abstract account. No specific details regarding companies, individuals, locations, or dates have been included. The incident was documented by WirtschaftsWoche, ZEIT/dpa, and heise online, among others. Our study is based on documented work progress from the engagement.
Recurring service modules
Independent Assessment of the Situation
Developing Operational Decision-Making Capabilities
Structured restart
Lorem Ipsum
Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet.
Do these situations sound familiar to you?
Your initial consultation with us is confidential and is intended to help us assess your situation.
Fast. Focused. Effective.
After one or two meetings, we’ll know where you stand and what matters most next. You’ll get a clear picture and initial ideas—not in weeks, but in days.