Cyber attack on Berlin Senate administrations: 5.7 terabytes in dark web, analysis to take weeks
Hackers from the Rhysida collective stole 1.2 million files from two Berlin Senate administrations. According to the BSI president, damage assessment will take several weeks.
Berlin Senate administrations after cyber attack: forensic investigation not yet concluded
As reported by the Frankfurter Allgemeine Zeitung, hackers stole more than 1.2 million files with a total volume of 5.7 terabytes from two Berlin Senate administrations. The data has been accessible in the dark web since Friday. According to government representatives, full processing of the incident will still take considerable time.
Digital State Secretary Florian Hauer (CDU) stated on Monday afternoon in the digital committee of the House of Representatives that the Land of Berlin continues to conduct forensic investigations of all IT systems at state and district level. The investigations check whether the attackers are still active in the state network and could be preparing further attacks. This investigation will take "a few more days".
The damage assessment is proving labour-intensive: on Monday afternoon, IT technicians were still downloading the files published in the dark web. The low data bandwidth of the illegal servers is significantly slowing down the process. Claudia Plattner, president of the Federal Office for Information Security (BSI), explained in the committee that this is not unusual — the hackers used small, "well-hidden" servers that only allowed slow data leakage.
After downloading, the files are to be pre-sorted using artificial intelligence according to their potential sensitivity. Subsequently, administration staff must manually review the contents and identify all those affected by the data theft. Plattner estimated the timeframe for this damage assessment at "a few weeks".
Journalists' investigations in the dark web in recent days revealed that in addition to personal data of employees, emergency plans for the protection of critical infrastructure were also stolen. Hauer said that files serving the "collective security" would be reviewed as a priority. He currently ruled out a threat to "national defence capabilities".
The attack is believed to be the work of the hacker collective Rhysida, which first appeared in May 2023. Who is specifically behind it remains unclear. Industry observers suspect Russian involvement based on sophisticated attack patterns — to date, no Russian or Russia-aligned organisations have been attacked. Roughly half of the known victims to date are based in the United States, roughly a quarter in Europe. Globally, around 300 institutions have been affected by Rhysida attacks.
The collective operates so-called ransomware-as-a-service (RaaS): hacker software including services that cybercriminals can rent. It encrypts data so that owners no longer have access — release typically occurs only in exchange for ransom.
In the Berlin case, the attackers had demanded a payment of thirty bitcoins, equivalent to around two million euros. In mid-August, they gave the Senate a week's deadline; if payment was not made, they threatened to publish all data in the dark web. The black-red Senate rejected the demand with opposition approval — whereupon the data were indeed posted online on Friday.
Both Hauer and Plattner assessed it in the committee as "a blessing in disguise" that the attack had been discovered before the hackers had begun encryption. The data were merely copied and remain available in the affected Senate administrations.
Rhysida had previously attracted attention several times using similar methods: in May 2023 at Kaiserslautern University of Applied Sciences, shortly thereafter at an American health authority, in autumn 2023 at the British Library and King Edward VII's Hospital in London, and in spring 2026 at Stuttgart's administration.
In the digital committee, representatives of all factions were fundamentally in agreement with the Senate's approach. However, the Greens, the Left and the AfD called for more comprehensive information about the extent of the damage. Left-wing faction leader Tobias Schulze suggested declaring a major damage situation, which would grant the Land of Berlin extended powers over the districts. State Secretary Hauer considered this unnecessary, but acknowledged that the willingness of the districts to cooperate was "differently pronounced".
Source: Frankfurter Allgemeine Zeitung