Berlin Ransomware Attack Exposes National Defense Secrets
Hackers leak 6TB of classified data after government refuses Bitcoin ransom demand.
1The Breach Overview
The Rhysida ransomware group leaked 5.79 terabytes of sensitive Berlin government data after authorities refused to pay a 30 Bitcoin ransom. The dump includes 1.44 million files containing personal data of 12,076 individuals, 16,389 email addresses, and 11,963 phone numbers. Critical infrastructure vulnerabilities and classified defense documents were exposed, including chemical-biological threat response plans. This marks one of the most severe government data breaches in European history.
2Sensitive Data Exposed
The leaked trove contains over 5,000 personnel files, payroll data, and leadership information. System credentials for critical platforms like GebäudAtlas and payment databases were exposed in plaintext. Court cases, disciplinary proceedings, and Bundesrat committee protocols appeared in the dump. Investigative journalist Lars Winkelsdorf called it worse than all terrorist attacks combined due to the inclusion of national defense contingency plans.
3National Security Implications
The breach exposed Berlin's secret communication channels for apocalyptic scenarios and emergency response blueprints. CBRN (chemical-biological-radiological-nuclear) defense frameworks were compromised, giving hostile actors potential attack roadmaps. The data includes vulnerability analyses of Berlin's water supply infrastructure, creating physical security risks beyond digital exposure.
4GDPR and Legal Fallout
Rhysida claims the leak violates GDPR, German classified-information laws, and critical infrastructure protection acts. With 148 exposed IBANs and sensitive HR records, the breach triggers mandatory reporting requirements affecting thousands. Legal experts anticipate years of litigation from affected citizens and businesses over the exposure of personal and commercial data.
5Government Response
Berlin established a central crisis unit to assess the damage and notify affected parties. Authorities maintain their no-ransom policy despite the unprecedented scale of exposure. The city faces mounting criticism for treating cybersecurity as an IT cost rather than strategic defense. Officials are scrambling to contain the fallout while evaluating compromised systems across multiple agencies.
6Hacker Group Profile
Rhysida operates as a ransomware-as-a-service collective, targeting high-value government and healthcare entities. Their leak site listed the Berlin data under a minimalist 'Germany' header before full publication. The group follows the double-extortion model - encrypting systems while threatening data exposure. Cybersecurity firms estimate their average ransom demand at $5 million per incident.
7Historical Context
This breach surpasses Germany's 2015 Bundestag hack and 2021 EU Parliament attacks in data volume and sensitivity. It follows a global trend of ransomware groups shifting from private sector to government targets for higher-impact extortion. Recent victims include Costa Rica's government (2022) and Toronto's Hospital for Sick Children (2023), demonstrating escalating boldness in cybercriminal tactics.
8Systemic Vulnerabilities
Experts warn that outdated network segmentation and inadequate cybersecurity budgets enabled this breach. Many government systems still rely on legacy infrastructure with poor access controls. The incident highlights the need for air-gapped storage of critical defense documents. Until boards treat digital security with physical security's urgency, such catastrophic leaks will continue occurring globally.
Original article: Security Affairs — Berlin Ransomware Attack Exposes National Defense Secrets