BaFin fines TeamViewer over delayed cyberattack disclosure

Definition and scope of the ad-hoc disclosure obligation

Specifically, the supervisor faulted a violation of Article 17(1), first subparagraph, of the MAR. "The ad-hoc disclosure obligation is anchored in the MAR," the authority's statement said. The provision obliges issuers to disclose inside information "immediately." Inside information is defined by the regulation as "non-public, precise information that relates, directly or indirectly, to one or more issuers or one or more financial instruments and which, if it were made public, would be likely to have a significant effect on the prices of those financial instruments or related derivative financial instruments."

BaFin is the competent authority for enforcing ad-hoc rules. "BaFin can punish this with a fine," the supervisor made clear. The maximum sanction for violations of the ad-hoc disclosure obligation is, according to BaFin, 2.5 million euros, "or up to two percent of total revenue." The fine of 240,000 euros now imposed therefore falls well below the statutory maximum that the authority took into account when determining the penalty.

Cyberattack as inside information

The background to the proceedings is a cyberattack on TeamViewer that, according to the company, occurred approximately two years ago. "A cyberattack had been carried out on TeamViewer SE," BaFin confirmed. BaFin classified the fact of the cyberattack as price-relevant inside information that the company should have disclosed immediately – particularly given that TeamViewer SE is a software company whose business model is built on IT security and remote-maintenance solutions.

Independently of the fine announcement, several major banks continue to rate the software company's stock cautiously. Deutsche Bank AG issued a "Hold" rating on TeamViewer on May 7, 2026. Barclays Capital rated the stock "Equal Weight" on the same day. Joh. Berenberg, Gossler & Co. KG (Berenberg Bank) confirmed a "Hold" rating on May 12, 2026, and Goldman Sachs Group Inc. assigned a "Neutral" rating to the shares on May 18, 2026.

Analyst ratings remain subdued

BaFin announced the fine in an official communication. The proceedings underscore that the supervisory authority acts consistently against violations of the ad-hoc disclosure obligation – even if the sanction imposed is moderate compared to the statutory maximum. For TeamViewer, the notice represents reputational damage, since as a provider of IT security and remote-maintenance software, the company is particularly expected to disclose cyber incidents in a timely manner.

The publication of the sanction was issued via Dow Jones Newswires on July 20, 2026, at 01:30 ET (05:30 GMT). TeamViewer has so far not publicly commented on either the specific amount of the fine or BaFin's allegations. It remains to be seen whether the company will lodge legal remedies against the penalty notice.