BERLIN, Sept. 2 — Berlin’s state government says it is the target of an extortion attempt following the August compromise of its administrative network, and it is refusing to pay. The confirmation came after a special Senate session at the Rotes Rathaus, where Governing Mayor Kai Wegner said, “The state of Berlin is being blackmailed,” per the machine-translated English version on the city’s official portal.
Forensic work has uncovered further data outflows in the portfolio of the Senate Department for Mobility, Transport, Climate Protection and Environment, with the exfiltration dated between August 7 and August 12. The Senate Chancellery said the scope and content are still being examined, and that personal or other non-public data cannot be excluded from what was taken.
The department first reported an outflow on August 7 — a full seven days before it was cut off from the network on August 14. Berlin has published no figure for how much data left the network. The only itemized account in circulation is the attackers’ own: a leak-site post indexed on August 28 that claims 5.79 terabytes of data and personal information on 12,076 individuals.
The Senate’s two releases on the incident carried no guidance for people whose records may be among the data as of August 29. The Senate Chancellery said the state criminal police, the public prosecutor, and federal security authorities are investigating the suspected perpetrators, and identified no group behind the attack.
Der Spiegel has named Rhysida as the group that first reported the attribution on August 28, citing an entry on the group’s darknet leak site and security sources. The Hacker News confirmed via a leak-site monitoring service on August 29 that an entry titled “Berlin, Germany” was added to Rhysida’s leak site on August 28. The post claims to have scanned 5.79 terabytes of data and around 1.44 million files, identifying the victim only as Berlin, Germany.
No ransom figure appeared in the entry. Its eleven file categories — the largest of which is 124,823 maps and geodata files — together account for about a quarter of the claimed total file count. Berlin first disclosed the incident on August 17, saying forensic work had established a compromise of the state network and that both affected departments had been isolated since the previous Friday.
At an August 19 press conference, Wegner said the incident was and remains serious, but emphasized that, based on current knowledge, no sensitive data had left the state network. Housing benefit applications and payments were unavailable while the two departments were off the network.
All Senate departments were reconnected on August 23, and forensic work and scanning of the state network continue. Interior Senator Iris Spranger said that as things stand, no data left the areas relevant to the conduct of the September 20 Abgeordnetenhaus election, and that her security officers regard the election environment as secure. The Senate Chancellery said Berlin’s state data protection commissioner and the Federal Office for Information Security (BSI) are being kept informed on a continuing basis.
