Berlin Administration Suffers Massive Data Breach After Refusing Ransom Demand

Hackers have stolen between 5.7 and 5.8 terabytes of data, comprising approximately 1.2 to 1.44 million files, from two Berlin Senate administrations. The data was published on the darknet last Friday after the Berlin Senate, with the support of the opposition, refused to pay a ransom demand of thirty Bitcoin, which is valued at roughly two million euros. The stolen information includes personal data of employees and citizens, as well as sensitive documents regarding critical infrastructure, such as emergency plans for power plants, fuel depots, and prisons.

Digital State Secretary Florian Hauer and Claudia Plattner, President of the Federal Office for Information Security, stated that the city was lucky the attack was discovered before the hackers could encrypt the systems. Because the attackers only copied the data rather than locking it, the administration still has access to its own files. However, the process of downloading the leaked data from the darknet is taking several days due to low bandwidth on the hackers' servers. Officials expect the full damage analysis, which will involve using artificial intelligence to sort through the files, to take several weeks.

The attack is attributed to the hacker collective Rhysida, a group that provides ransomware as a service. While the group's exact origins are unclear, industry observers suggest Russian involvement because the group typically does not target Russian institutions. One report notes that the breach began when an employee clicked on a phishing email in early August.

Perspectives on the event vary by political lean. Center right sources frame the incident as a symptom of broader state vulnerability and a failure to modernize IT infrastructure, with some suggesting it fits a pattern of Russian hybrid warfare. A center left source focuses on the specific extent and sensitivity of the leaked data.