Berlin’s state government has confirmed an extortion attempt following a data theft from its administrative network in August.
Governing Mayor Kai Wegner and Interior Senator Iris Spranger addressed the extortion attempt on Friday, following an emergency Senate session at the Rotes Rathaus. “The state of Berlin is being blackmailed,” Wegner said.
“Berlin has fallen victim to a serious crime.” He confirmed the city will not meet the attackers’ demands, and said the State Criminal Police Office, the public prosecutor’s office, and federal security agencies are investigating the suspected perpetrators together.
The leak is believed to have happened between August 7 and 12. The affected departments weren’t disconnected from the state network until August 14.
“Following the ICT incident, ongoing forensic investigations have revealed further data leaks within the Berlin state network of the Senate Department for Mobility, Transport, Climate Protection and the Environment. The content and scope of the affected data are still being examined,” reads the statement.
Officials stated that it cannot be ruled out that personal data or other non-public data is affected.
Spranger said the technical environment supporting the upcoming Berlin House of Representatives election is protected against the kind of attack that hit the Senate administration. “As far as we know, no data has been compromised there,” she said. “According to our security officers, the election environment is secure.”
Rhysida claims 1.44 million files in Berlin data breach
Although city officials haven’t shared details on who is behind the intrusion or how many records are affected, the Rhysida ransomware gang has listed Berlin on its data leak site.
Rhysida’s listing puts the total at 5.79 TB across 1.44 million files. The gang’s breakdown by category includes 124,823 mapping and geodata files, 77,939 legal and complaints files, 55,553 financial files, 46,522 contracts, 27,299 HR files, 13,142 government supervisory files, 11,777 marked confidential, 8,110 infrastructure files, 5,941 containing passwords, 2,738 health-related files, and 2,287 contact files.
The claimed data includes 16,389 email addresses, 11,963 phone numbers, personal information tied to 12,076 individuals, and 148 IBANs. Rhysida says it holds plaintext credentials from several internal systems, including a building-management database, a payment-processing database, and login data belonging to Berlin’s leadership.
The listing references an active disciplinary case with more than 400 files tied to a lawsuit before the Berlin Administrative Court, Bundesrat committee protocols, classified-material handling records, and recent passport and ID scans.
Other claimed material includes vulnerability assessments of Berlin’s water supply, more than 5,000 personnel files, payroll data, more than 5,000 administrative-offense files, SQL dumps spanning 2020 to 2026, and 3,226 nondisclosure agreements.
According to Der Spiegel, the hackers are demanding 30 bitcoin which is around 2 million euros at current exchange rates.
Rhysida ransomware has been active since May 2023 and made a name for itself by attacking the British Library, the Chilean Army, healthcare delivery organizations, and Holding Slovenske Elektrarne (HSE).
