Hacker attack on Berlin: 1.4 million records stolen, extortion attempt fails
Hacker group Rhysida stole 1.4 million records from Berlin's administration and demanded two million euros in ransom. The Senate responded several days too late.
Chronology of IT failure: Berlin's administration under hacker attack
Secret crisis plans, contracts and employee account data – a total of 1.4 million records have been stolen from Berlin's state network by cybercriminals and subsequently offered for sale. As BILD reports, Governing Mayor Kai Wegner (53, CDU) underestimated the attack over weeks, although digitalisation in Berlin has been a matter of top priority for the past three years.
Friday, 14 August: In the evening, the Senate administrations for transport and urban development are disconnected from the state network. Emails can no longer be sent, working from home is no longer possible. Subsequent investigations show that the data was leaked between 7 and 12 August – the cyber attack went undetected for several days. The exact beginning of the attack remains unclear.
A structural problem exacerbates the situation: the two affected Senate authorities are not protected by the state-owned IT service provider ITDZ and manage software updates and security measures independently. Tobias Schulze (50, Left), a long-standing member of the Berlin parliament's IT committee, criticises to BILD: "They are not at the required level of security technology."
Monday, 17 August: After a weekend of silence, the Governing Mayor's press office officially informs for the first time of an "incrimination" of the state network. The state criminal police office, public prosecutor's office and the Federal Office for Information Security (BSI) are involved, a crisis team is established. Digital State Secretary Florian Hauer (47) explains that, to his knowledge, no sensitive personal data has been leaked. Hauer had only taken over responsibility in May after his predecessor resigned. Senate spokesperson Christine Richter justifies the late public information by saying that securing the state network and safeguarding the upcoming state parliament election had taken priority.
Wednesday, 20 August: Wegner declares at a press conference that the attack is serious, but to his knowledge no sensitive data has been leaked.
Sunday, 23 August: The Governing Mayor reports that all Senate administrations are back online and basically operational.
Wednesday, 26 August: A press release follows with the official admission: it cannot be ruled out that personal data or other non-public data has been leaked. At the same time, the Senate assumes that the attack has been contained.
Friday, 28 August: Hacker group Rhysida offers the stolen data at auction. Minimum bid: 30 Bitcoin, equivalent to approximately two million euros. Wegner responds publicly: "The Land Berlin will not be extorted." Internally from the Senate, the comment is: "If we pay now, they'll demand 10 million euros next time."
Thursday, 3 September: The press office warns that the alleged perpetrators could publish the data the following day. The data affected includes personal information of employees, citizens and companies. Whether the state network is still infiltrated remains unclear at this time. The Senate advises those affected to file a report via the police's online reporting service.
Friday, 4 September: After the deadline expires at 15:35, the Senate admits: "The Land Berlin has become the victim of an extremely serious criminal offence." Authorities announce they will inform identified victims.
Saturday, 5 September: When asked by BILD whether the IT disaster is worse than the Berlin power cut in January affecting 50,000 households, Wegner replies: "I cannot say that today." The security authorities would first have to examine which data has actually been leaked. The FDP calls for his immediate resignation. Ten concerned employees and eleven citizens contact the authorities with questions about the published data.
Source: BILD