Cyber attack on Berlin administration: BSI warns of phishing and hack-and-leak
Following data theft by the hacker group Rhysida, the BSI has warned of targeted phishing attacks and politically motivated data misuse shortly before the Berlin election.
BSI warns of increased threat level following Berlin data breach
Following the publication of stolen administrative data on the dark web, the Federal Office for Information Security (BSI) has pointed to an increased threat level. According to Deutsche Welle, the data breach could result in "various risks for those affected and ultimately for society," explained a BSI spokesperson.
Particular warnings are being issued about targeted phishing attacks following the breach. According to the BSI, individuals who were in contact with affected authorities or institutions should exercise special caution.
Risk of political interference ahead of House of Representatives election
With regard to the Berlin election on 20 September, the BSI warns of so-called hack-and-leak operations: stolen documents or emails are published at a strategically chosen time — sometimes taken out of context. However, according to the BSI, a political motive on the part of the attackers themselves is not suspected; it is assumed that the act was "exclusively financially motivated".
5.8 terabytes of data published on dark web
The criminal hacker group Rhysida initially demanded a ransom of 30 Bitcoin — equivalent to approximately two million euros. The Berlin Senate refused to pay. After a deadline expired on Friday afternoon, the group published a 5.8 terabyte data package. According to their own claims, the attackers obtained around 1.44 million individual files, including more than 5,000 personnel records, penalty proceedings, salary statements, confidential documents from Bundesrat committees, and vulnerability analyses relating to Berlin's drinking water supply.
The extortionists also claimed to have obtained access credentials and passwords in plain text — including for administrative databases and payment service providers. The accuracy of these claims has not yet been confirmed.
Federal authorities cross-checking information
Governing Mayor Kai Wegner told the Bild newspaper that it was currently being examined which information had been leaked; the aim was to reach those affected as quickly as possible. Wegner had made public at the end of August that Berlin was being extorted following the cyber attack.
A government spokesperson stated that the federal government was closely monitoring the investigations at the state level. The BSI, the Federal Criminal Police Office and the Federal Office for the Protection of the Constitution were continuously coordinating their findings. According to current knowledge, data systems of the federal government were not affected; after completion of the risk analysis, measures would be initiated to protect military security.
The BSI recommends those affected to check whether and to what extent their own data has been published, and to adjust internal processes if necessary.
Source: Deutsche Welle