Berlin City Administration Hit by Major Cyberattack and Data Leak

The Berlin city administration has been targeted by a hacker attack that resulted in the publication of a large volume of data on the darknet. The breach forced two senate administrations to be disconnected from the state network and disrupted the processing of housing benefit applications for over 50,000 households for several weeks. While the senate initially provided limited confirmation, reports indicate the leaked data includes approximately 46,500 contracts, 78,000 records from regulatory offense proceedings and lawsuits, and 27,000 personnel files and payroll records. Some reports further suggest that roughly 8,000 files concerning critical infrastructure and classified content regarding civil protection and defense were compromised.

Cybersecurity expert Michael Waidner attributes the attack to the ransomware group Rhysida, which is known for a double extortion model of encrypting data and threatening its release. Waidner notes that such attacks are often financially motivated and opportunistic, frequently gaining initial access through stolen or guessed employee credentials. He warns that the availability of AI tools is making it easier for a growing number of actors to carry out such breaches.

Coverage of the event differs in focus based on political lean. A center left source frames the event as a personal crisis for the public, focusing on the consequences for citizens and providing guidance on how individuals can protect themselves from data leaks. In contrast, a center right source frames the event as a systemic failure of administrative digitalization and a broader security threat, emphasizing the vulnerability of critical infrastructure and the growing capabilities of cyber attackers.