The recovery of business-critical data following cyber-attacks is becoming increasingly important within the field of IT security. At the it-sa Expo&Congress 2026 in Nuremberg, the focus will therefore be not only on preventative security measures but also on technical data recovery and the coordinated management of serious security incidents. The Leipzig-based data recovery specialist DATA REVERSE has drawn a positive interim conclusion halfway through the trade fair. According to the company, technical discussions so far have centred in particular on the recovery of damaged backup environments and collaboration between specialist cyber emergency service providers.
The it-sa Expo&Congress is taking place from 27 to 29 October 2026 at the Nuremberg Exhibition Centre. According to NürnbergMesse, more than 1,000 exhibitors are expected for the first time, compared with 993 companies last year. All five exhibition halls are fully booked, with around 30 per cent of exhibitors coming from abroad. This trend highlights the international significance of the event as a meeting place for the cyber security industry. For DATA REVERSE, one question in particular is at the forefront: How can companies restore their data following a successful attack and resume business operations as quickly and in as controlled a manner as possible?
Ransomware attacks complicate recovery
According to DATA REVERSE’s observations, discussions at the trade fair so far with system integrators, IT service providers and security managers have increasingly focused on complex recovery scenarios following ransomware attacks. In addition to traditional data loss caused by hardware faults or damaged storage systems, the focus is particularly on virtual infrastructures and compromised backup repositories, including environments with Veeam backups.
The technical challenge arises above all when attackers not only encrypt production systems but also damage, delete or render backup repositories unusable. In such cases, standard data recovery may fail, even though backups were originally available. Whether data can still be reconstructed depends, amongst other things, on the condition of the remaining data structures, the completeness of the backup chains and the integrity of individual files. Successful recovery is therefore not possible in every instance of damage.
For organisations, this underlines the need for a comprehensive recovery strategy. Regular backups alone do not guarantee sufficient cyber resilience. Additional key factors include protected and, where possible, immutable backup copies, separate access permissions, and regularly tested recovery procedures. Equally important is coordination with IT forensics to ensure that, when operations resume, no relevant traces of an attack are lost and no compromised systems are reintegrated.
Cybernotfall24 brings together specialised services
Another key focus of the trade fair presentation is the Cybernotfall24 initiative, which is being showcased jointly for the first time. The companies aconitas, Schneider & Wulf and DATA REVERSE are collaborating under this brand. The offering combines expertise in incident response, IT forensics, IT security and professional data recovery. The aim is to provide affected companies with coordinated access to various specialists in the event of a cyber emergency.
This approach addresses a key organisational challenge in the event of serious security incidents. Whilst incident response teams investigate attack vectors, isolate compromised systems and prevent further propagation, the conditions for a secure recovery must be established in parallel. These tasks require different areas of expertise but are closely interlinked in technical and time-related terms. For system integrators and IT service providers, collaboration with specialised partners can be particularly relevant when extensive forensic investigations or complex data reconstructions exceed their own capacities.
Whether this collaborative model proves successful in the long term depends largely on clear lines of responsibility, coordinated response processes and reliable communication between the service providers involved. This is because, particularly in the event of a cyber incident, it is not only the availability of technical expertise but also its coordinated deployment that determines the duration of any business interruption.
Cyber resilience is becoming a matter of recovery capability
DATA REVERSE’s interim findings highlight the importance of recovery capability within organisational IT security planning. These assessments are based on the company’s contacts at trade fairs to date and do not constitute a representative survey of the entire cyber security market. However, they highlight a key challenge: organisations must not only prevent attacks from succeeding, but also make provisions for the eventuality that protective measures are breached.
In practical business terms, this means that recovery times, the availability of unaltered backups and coordination between security management, IT operations and external specialists are taking centre stage. After all, the economic consequences of a ransomware attack depend not only on the immediate loss of data, but also on production downtime, reduced service capacity and the duration of the recovery process.
DATA REVERSE will be present at joint stand 8-118 in Hall 8 until 29 October 2026. The company operates a data recovery laboratory in Leipzig and is certified to ISO 9001 and ISO/IEC 27001.
The key insight for businesses is this: cyber resilience does not end with the successful defence against an attack. It is demonstrated above all by how controlled, secure and rapid the recovery of business-critical systems can be following a security incident.
