Berlin’s state government has confirmed significant new details regarding a recent Berlin cyberattack on its critical network infrastructure. Authorities now warn a potential data leak, stemming from this breach, could occur as early as today. This alarming development follows a sustained extortion attempt against the German capital.
The notorious Rhysida ransomware group has publicly claimed responsibility for the intrusion. This group asserts it holds 5.7 terabytes of sensitive stolen data. Furthermore, reports indicate Rhysida has been actively attempting to extort the city since last Friday. They have initiated an auction for the compromised data, setting a minimum bid of 30 Bitcoin, which translates to approximately two million Euro.
Officials suggest the leaked information might contain personal data belonging to Berlin state employees. Moreover, residents and local businesses could also be affected. The full extent of the data compromise is still under comprehensive investigation.
In response, various agencies are collaborating closely. The Senate is working alongside Berlin’s State Criminal Police Office (LKA), the Berlin public prosecutor’s office, and the Federal Office for Information Security (BSI). Other federal security agencies are also providing support. The LKA has established specialized units to manage the inquiry, analyze the attack’s specifics, and secure the impacted data. Simultaneously, a joint task force has emerged, involving the two Senate departments directly affected by the incident.
The Senate Department for Urban Development, Building and Housing leads the overall crisis management. Its dedicated crisis unit oversees the coordinated response. Additionally, a contact point for staff has been opened, and an external legal advisor is now assisting employees with sensitive or legally pertinent issues.
Authorities currently report no evidence of ongoing network compromise. However, forensic examinations are continuing diligently. These investigations aim to ascertain whether additional data may have been exfiltrated. Berlin’s IT emergency task force also maintains regular meetings to address the situation.
Should analysis of the leaked data identify specific individuals, relevant Senate departments will provide notifications. This will occur on a risk-assessed basis, fully adhering to the EU’s General Data Protection Regulation (GDPR) and Berlin’s state data protection laws. Individuals whose data becomes public are strongly advised to file a police report. This can be done via the Berlin police’s online portal or at any local station. City employees have also received assurances of available counseling support.
Florian Hauer, Berlin’s Chief Digital Officer, adopted a resolute stance against the attackers. He declared that the city “will not be extorted,” emphasizing that safeguarding Berlin’s employees and residents remains paramount. Hauer confirmed that authorities are collaborating at full speed with state and federal security agencies. Their joint efforts focus on securing the network and bolstering its defenses further. He characterized the Berlin cyberattack as a serious criminal act, detrimental to the entire city. Finally, Hauer extended his gratitude to everyone involved, commending their “close and trusting cooperation” during recent challenging days.
