started · updated
Berlin administration suffers massive data leak after ransomware attack
The Berlin state administration has suffered a massive cyberattack by the Rhysida ransomware group, resulting in the leak of approximately 1.44 million files totaling 5.8 terabytes of data on the dark web. The breach, which affected the Senate departments for Building and for Transport, occurred after hackers gained access to the Berliner Landesnetz between August 7 and August 12.
Berlin authorities refused to pay a ransom demand of 30 Bitcoin, valued at approximately two million euros. Following the refusal, the attackers began publishing sensitive datasets. The leaked information includes personal data of administrative employees, such as employment certificates and emergency plans, as well as highly sensitive documents related to critical infrastructure. This includes vulnerability assessments for Berlin’s water supply, plans for chemical, biological, radiological, and nuclear (CBRN) threat scenarios, and information regarding power plants and fuel depots.
Political leaders and IT experts have criticized the government's crisis management. Experts from the Chaos Computer Club noted a significant delay in disconnecting affected systems, which allowed the attackers a seven-day window to extract data. Politicians have called for increased investment in cybersecurity and have demanded accountability from state leadership, citing the incident as a major threat to national security and a potential 'data super-disaster'.
Entities
BSI · Berlin · Berlin Administration · Berlin Senate · Chaos Computer Club · Federal Office for Information Security · Florian Hauer · Franziska Giffey · German Federal Government · Iris Spranger · Kai Wegner · Konstantin von Notz
Claims
What the coverage asserts, and how many sources carry each claim.
- [● 19 SOURCES] The breach affected the Senate departments for Building and for Transport. lagacetaonline.com.ar · bitcoinethereumnews.com · www.leinetal24.de · www.waltroper-zeitung.de · www.epochtimes.de · +10 more
- [● 24 SOURCES] The hacker group Rhysida demanded a ransom of 30 Bitcoin, approximately two million euros. lagacetaonline.com.ar · bitcoinethereumnews.com · www.leinetal24.de · www.waltroper-zeitung.de · www.epochtimes.de · +16 more
- [● 26 SOURCES] Approximately 1.44 million files totaling 5.8 terabytes have been published on the Darknet. www.leinetal24.de · www.waltroper-zeitung.de · www.epochtimes.de · www.stimberg-zeitung.de · www.finanzen.net · +18 more
- [● 15 SOURCES] Experts suggest the leak may include highly sensitive data regarding civil protection and defense companies. www.leinetal24.de · www.waltroper-zeitung.de · www.epochtimes.de · www.stimberg-zeitung.de · www.finanzen.net · +7 more
- [● 10 SOURCES] Konstantin von Notz described the data leak as a 'real data super-disaster' and blamed the federal government for massive failures. www.leinetal24.de · www.waltroper-zeitung.de · www.epochtimes.de · www.stimberg-zeitung.de · www.finanzen.net · +4 more
- [● 14 SOURCES] The leaked data includes personal information of administrative employees, such as employment certificates and emergency plans. lagacetaonline.com.ar · www.leinetal24.de · www.waltroper-zeitung.de · www.epochtimes.de · www.zdfheute.de · +7 more
- [● 6 SOURCES] Roderich Kiesewetter stated that the data leak is of grave magnitude and endangers national security. www.epochtimes.de · www.finanzen.net · www.waltroper-zeitung.de · www.tagesschau.de · www.leinetal24.de
- [● 11 SOURCES] Hackers gained undetected access to parts of the Berlin state network between August 7 and August 12. www.epochtimes.de · www.finanzen.net · www.zdfheute.de · www.sofx.com · www.berliner-zeitung.de · +3 more
- [● 10 SOURCES] The Berlin Senate refused to pay the ransom demand. lagacetaonline.com.ar · bitcoinethereumnews.com · www.sofx.com · www.berliner-zeitung.de · www.bild.de · +4 more
- [● 4 SOURCES] Leaked data includes personal information of administrative employees, such as employment certificates and emergency plans. lagacetaonline.com.ar · www.sofx.com · www.zdfheute.de
- [● 8 SOURCES] A subsequent data package containing internal access credentials was released by the attackers. www.rbb24.de · www.berliner-zeitung.de · www.bild.de · securityaffairs.com · www.infomagazine.ma · +2 more