Hacker attack on Berlin: 5.8 terabytes of data published on darknet
The hacker group Rhyside has leaked 1.44 million files following an attack on the Berlin state network. Security experts warn of risks to critical infrastructure.
Berlin Senate administration: millions of stolen files end up on darknet
The extortion threat came to pass: after the Berlin Senate rejected a ransom demand of 30 Bitcoin – equivalent to approximately two million euros – the hacker group Rhyside published 1.44 million stolen files with a total volume of 5.8 terabytes on the darknet on Friday. According to the Frankfurter Allgemeine Zeitung, the incident ranks among the severest cyberattacks on a German state administration.
Undetected in the network for three weeks
Between 7 and 12 August, the attackers gained undetected access to parts of the Berlin state network. The Senate administrations for construction and transport were affected. The administration only discovered the breach on 14 August – and informed the public three days later. The full extent of the data theft only became known gradually.
Contents of the leak: personnel files to emergency plans
A complete overview of the stolen data is not yet possible, as sifting through the vast quantities of data requires time. According to the Chaos Computer Club, the material includes personal data of administrative staff, personnel records, work references, and emergency plans.
The Tagesspiegel also reported that the hackers published content with security-relevant significance for the German federal state and the capital – including information about particularly sensitive facilities such as power plants, fuel storage depots, emergency power systems and transformer stations. Data relating to prisons, water utilities, defence companies, the German armed forces and Berlin's interior administration are also said to be affected.
Jochim Selzer, spokesperson for the Chaos Computer Club, explained that he had examined part of the documents and found sensitive information about the condition of Berlin's water supply. IT expert Manuel Atug, founder of the independent AG Kritis working group, stated that he had not viewed the data himself on ethical grounds, but had learned from credible sources that the information concerning civil defence and defence companies was at least partly accurate.
Federal authorities support analysis
The Berlin Senate announced on Friday evening that the security authorities were conducting an "intensive data review" and IT forensics specialists were investigating the leak "at high speed". Affected individuals should be informed "on a risk-based basis and in accordance with legal requirements" once they have been identified.
The Federal Interior Ministry confirmed that the Federal Office for Information Security (BSI), the Federal Criminal Police Office and the Federal Office for the Protection of the Constitution are supporting the land of Berlin in the analysis. A government spokesman stated that, to the best of current knowledge, data systems of the federal government are not affected.
A spokesperson for the operational command centre of the German armed forces referred to the ongoing analysis by the responsible authorities and announced that after assessing possible security risks, appropriate measures would be initiated. This would also be coordinated via the National Cyber Defence Centre.
Risks: identity theft and targeted phishing attacks
Should it be confirmed that the leaked data contains security-relevant information, this could theoretically be used by foreign powers or terrorists. The BSI pointed out that information on critical infrastructure could, depending on sensitivity, increase the threat level.
Selzer from the Chaos Computer Club emphasised the danger of identity theft: "The more I know about a person, the more precisely I can impersonate that person, the more precisely I can also assess what I need to know about that person, for example to place an order on their behalf."
The BSI also warned of targeted phishing attacks following the data breach. People who have been in contact with affected individuals or institutions should be particularly vigilant.
Expert: acted with "gross negligence"
IT specialist Atug accused the land of Berlin of acting with "gross negligence" and failing to comply with classified information protection regulations. Strict regulations and multiple security levels exist for the storage and processing of classified information – these apparently were not sufficiently applied.
The Police Union (GdP) in Berlin responded with sharp criticism. Deputy State Secretary Thorsten Schleheider said: "He has once again made it abundantly clear to Berlin's politicians that people have been asleep at the wheel here for years." It could not be the case that highly sensitive data had been stolen over several days and the only visible response was to ask employees to change their passwords. "That shows a certain sense of helplessness."
Source: Frankfurter Allgemeine Zeitung