Berlin Refuses to Pay Ransom for Stolen State Network Data
Hackers stole 5.79 terabytes of data, Berlin stands firm against extortion demands.
1Attack Scale
A cyberattack on Berlin's state network resulted in the theft of 5.79 terabytes of data. Hackers claim to have obtained personal information of 12,076 individuals. The data breach began in early August, occurring between August 7-12. Senate officials confirmed sensitive information might be among the stolen data.
2Rhysida Hacker Group
The Rhysida group behind the attack previously targeted Stuttgart city administration and Welthungerhilfe aid organization. U.S. cybersecurity agencies had warned about their double extortion tactics in November 2023. The group leaked data through a dark web post titled 'Berlin, Germany' on their leak site.
3Government Response
Berlin Mayor Kai Wegner declared the state won't yield to extortion after a special Senate session. Federal police and prosecutors are tracking the perpetrators. Election-related data remains unaffected and secure, officials confirmed. Forensic scanning of the state network continues.
4Ransom Policy
CISA and FBI warn that ransom payments encourage attackers and don't guarantee data recovery. Berlin's decision aligns with these international recommendations. Experts emphasize network segmentation and multi-factor authentication as critical defenses.
5Affected Systems
Housing benefit applications were temporarily suspended due to the attack. Two affected ministries were isolated from the network and reconnected on August 23. Senate maintains continuous communication with data protection authorities. Election systems were confirmed secure.
6Other Victims
Rhysida has reportedly victimized 280 targets globally. Other German victims include Stuttgart city and Welthungerhilfe. Internationally, the Port of Seattle was attacked in 2024. The group shows connections to Vice Society and employs similar tactics.
7Data Types
Stolen data includes 124,823 maps and geodata files, constituting about a quarter of total files. Hackers listed file categories but didn't disclose ransom amount. Berlin authorities continue investigating the full scope of compromised data.
8Sector Impact
This incident highlights growing cyber threats against government networks. Manchester Airports Group recently disclosed a similar attack. Experts urge immediate protective measures for critical infrastructure. Berlin's firm stance may set a precedent for other institutions.