Hacker attack on Berlin Senate: 5.8 terabytes of data on the darknet
Following a cyber attack on the IT systems of the Berlin Senate, 5.8 terabytes of confidential data has appeared on the darknet. Emergency plans, account data and millions of citizens' data are affected.
Berlin data breach: Rhysida group publishes 5.8 terabytes of stolen Senate data
Around 5.8 terabytes of sensitive data from the IT systems of the Berlin Senate are available on the darknet – including emergency plans, classified defence documents, official communications, birth certificates, telephone numbers and possibly millions of citizens' data. BILD inquired with authorities and security experts and reports on the current state of findings.
Timeline of the attack
The attack on Berlin's administration was discovered on 14 August. The affected systems were disconnected from the Berlin state network for approximately one week. On 28 August, first stolen data appeared on the darknet. Because the Berlin Senate refused to pay a ransom, the cybercriminals published the entire data package on 4 September at 15:35 – accompanied by the message: "All data has been made publicly accessible. Have fun with it, data hunters."
By comparison: one terabyte corresponds to a library with approximately 300 to 900 million book pages. The stolen volume of data is so large that a person could practically not read it in its entirety. Once published on the darknet, data is considered permanently accessible – copies can be stored worldwide and repeatedly re-uploaded.
Which data is affected?
According to current knowledge, secret emergency plans and classified defence papers are contained in the leaked data. In addition, there is official communications from civil servants, employment references, photographs and personal data of millions of Berlin residents – possibly including tax data.
From security circles, BILD learned that there are currently no concrete indications of data belonging to politicians, public figures, parties or office holders.
Regarding the defence documents: According to BILD, the leaked materials contain dozens of documents on the subject of defence, including a "civil defence guide" and presentations on "comprehensive defence". The highly classified "Operation Plan Germany" for national defence is not at risk, according to BILD information.
Federal Government and Bundeswehr respond
In response to a BILD inquiry, a government spokesman stated: "The Federal Government is closely following the information and investigations into the data leak. At present, the competent security authorities of the federal and state governments are evaluating the information." The spokesman added that data systems of the federal government are not affected according to current knowledge. The evaluation is also being conducted through the National Cyber Defence Centre; after analysis of potential security risks, measures to protect military security will be initiated.
From high-ranking Bundeswehr circles, an insider told BILD this was a "data-technical catastrophe": hostile actors both domestic and foreign had thereby been handed the blueprint for attacks on critical infrastructure on a silver platter. Bundeswehr experts are currently evaluating the data and searching for vulnerabilities. The Federal Defence Ministry (BMVg) told BILD that there is "continuous information exchange at the national cyber defence centre".
When asked whether architectural plans of sensitive buildings in the government district were also affected, a senior official told BILD: "It is obvious that properties in Berlin are also documented in Berlin's building authorities. But so far there is no evidence that information actually leaked from there."
Political reactions
CDU security expert Roderich Kiesewetter (62) expressed concern to BILD: whilst it was good that the Berlin Senate had not allowed itself to be blackmailed, he said: "Something like this should never have happened." And further: "It would be serious if our communication channels and crisis plans were laid bare."
Berlin's independent chief returning officer Stephan Bröchler (63) stated in response to BILD's inquiry that the electoral environment was not affected according to current information – "neither the preparations, nor the actual election day, nor the process up to the publication of the preliminary result." However, Bröchler conceded that in August there had been problems with the online application for postal voting materials, independently of the hacker attack.
Who is behind the attack?
According to current findings, the group "Rhysida" is responsible for the attack. There are indications of Russian origin: the group communicates predominantly in Russian and has attacked companies, authorities and organisations worldwide since 2023 – however not in Russia or CIS states. Their business model: steal data, encrypt systems, extort ransom.
Erik Heyland from the Management Board of the AV-TEST Institute commented to BILD on Rhysida – his full statement was not yet available in full at editorial deadline.
Risks for citizens and state
According to experts, the greatest immediate risks are misuse of personal and professional data, stolen access credentials, possible knowledge of critical infrastructure and disinformation campaigns. According to BILD reporters' assessment, the full extent of the damage cannot currently be gauged – the volume of compromised data is too great. To date, authorities have provided little concrete assistance for affected citizens.
Source: BILD