Hacker attack on Berlin: Entry via Mitte district office and State Administration
The hacker group "Rhysida" is said to have infiltrated Berlin's municipal networks over several months. Sensitive federal and infrastructure data was leaked.
Berlin's largest data disaster: how "Rhysida" penetrated deep into the capital's networks
After the massive cyber attack by the hacker group "Rhysida" on Berlin's administration, the extent of the damage is only becoming visible gradually. BILD spoke with several experts, officials and politicians and paints an alarming picture of the duration, scope and consequences of the attacks.
According to BILD information, it was not just the recent major attack that resulted in the leaking of security-relevant data from the federal government and critical infrastructure – there were several serious incidents over months in Berlin's data network.
Networks "as open as a barn door"
Several people involved quoted the now-dismissed digital state secretary Matthias Hundt to BILD as saying: "The networks in Berlin at the Senate and districts are as open as a barn door – and there is no information about which systems are where, with whom, with what software and what security standards are running."
When confronted with this by BILD, Hundt stated: "I cannot deny that." He declined to make further statements, citing his ongoing legal dispute with the State of Berlin.
Entry via Mitte district office – then Neukölln
Two people familiar with the matter described to BILD how the hackers are believed to have proceeded in the recent major attack: they initially gained entry through an email account of the Mitte district office, then accessed the state network via the Neukölln district administration. The cybercriminals are internally classified as a Russia-affiliated collective.
Mitte's district mayor Stefanie Remlinger (55, Greens) reacted with surprise: "That's news to me. I will question my crisis team immediately – they are on standby. In July, Mitte was the first district to install the new protection software."
The Senate Chancellery of Governing Mayor Kai Wegner (53, CDU) initially confirmed BILD's research in part: "There is currently evidence that the initial incident occurred at the Mitte district office." A senior representative of the Senate Chancellery later qualified this: "As things stand, we do not assume that this attempted entry was the initial incident." According to BILD, the decisive access ultimately came via the State Administration for the Environment.
IT chaos as a systemic failure
According to BILD, confidential discussions, minutes from the House of Representatives and audit office reports reveal a further structural problem: Berlin's IT is characterised by duplicate and triplicate structures. Even at the state-owned IT service centre Berlin (ITDZ), which is responsible for the networks of the state and districts, there was said to have been negligence.
According to two independent sources, this chaos is also believed to have played a role in the terrorist attack on the power grid in south-west Berlin in early January. In June 2025, a service provider was also hacked that had access to data and location plans of critical infrastructure – including water and power supplies. An insider told BILD: "The data completely leaked."
According to further reports, the cyber attack on a heating plant in Berlin-Neukölln on 20 March and the attack on Berlin's courts from 13 July – through which courts were sometimes unable to work or conduct hearings – are also believed to have originated from the same compromised service provider.
US expert warns of nationwide implications
US cyber security expert Professor Max Kilger (72), one of the world's leading experts in this field, told BILD that there could be "significant network connections between the attacked Berlin systems and other systems of the German federal government". In this case, it could be a "more serious incident" than is currently apparent.
Formally responsible for data security in Berlin is the Senate Chancellery – and thus Governing Mayor Kai Wegner (CDU), whose authority bears responsibility for the capital's largest data disaster in its history.
Source: BILD