Rhysida hacker gang publishes 1.44 million Berlin administration records on dark web
Criminal group Rhysida has released 5.8 terabytes of stolen Berlin administration data on the dark web after an ultimatum expired. BSI warns of phishing and identity theft.
Rhysida hackers place stolen Berlin data on dark web – BSI warns of phishing
About an hour after the ultimatum expired, members of the criminal hacker group Rhysida published a 5.8 terabyte data package from Berlin's state network on the dark web on Friday afternoon. According to Kleine Zeitung, the package contains approximately 1.44 million files, according to the extortionists' own claims – including personnel records, salary statements, penalty proceedings and confidential documents from federal council committees.
The countdown on the group's leak site expired on Friday at around 15.35. The extortionists had demanded 30 Bitcoin, equivalent to roughly two million euros. The Berlin Senate had previously stated it would fundamentally refuse to pay any ransom. Shortly after the deadline passed, a message appeared on the dark web page reading: "All files have been uploaded to the publicly accessible area – have fun browsing, data hunters!" A link initially led to an error message, but after one hour the data download was accessible.
Experts approve Senate's decision
The Senate's refusal to accede to the extortion received broad approval among experts. Bianca Kastl from the Chaos Computer Club said on RBB Inforadio that the decision was correct. "If you continue supporting these groups with money or other things, they will of course keep doing it," said Kastl. "You have to starve them financially."
IT security expert Christof Fischer told the German Press Agency that the state is prohibited by law from making ransom payments. Fischer did, however, acknowledge that such incidents are nevertheless difficult: "The data is in the hands of criminals, and publication often has very harmful consequences." He added that the perpetrators – who mostly live in Eastern European countries – would presumably make the stolen data accessible to the authorities there in order to purchase protection from investigation.
Highly sensitive data affected
According to the attackers, the published files include more than 5,000 personnel records, vulnerability assessments for Berlin's drinking water supply, and access credentials and passwords in plain text – including for administration databases and payment service providers. Application documents, emergency plans and materials from political operations are also said to be part of the dataset.
The Federal Office for Information Security (BSI) classifies the current threat level as elevated. "The BSI explicitly points out that the publication of stolen data can result in various risks for those affected and ultimately for society," said a spokesman for the agency. Particularly before elections, there is a danger of so-called hack-and-leak operations, in which stolen documents are published selectively and possibly out of context. Berlin's election for the state parliament takes place on 20 September.
Phishing danger for citizens and authorities
The BSI advises those affected to check whether they are specifically affected by the data breach and, if necessary, to adjust internal processes. Particular caution should be exercised against targeted phishing attacks – especially for individuals who had contact with affected institutions. Data on critical infrastructure could further escalate the threat level, the federal office warns.
IT security experts and Berlin's State Criminal Police Office (LKA) continuously monitor relevant forums and leak sites. In comparable attacks, it typically takes several hours or days before stolen datasets become fully available through archive files or peer-to-peer networks.
Cyber attack known since 14 August
Berlin's administration publicly confirmed the attack on 14 August. Subsequently, the Senate Department for Urban Development, Construction and Housing and the Senate Department for Mobility, Transport, Environment and Climate Protection were disconnected from the state network for approximately one week. For days, citizens in Berlin were unable to apply for or receive housing benefit payments. The LKA and BSI remain involved in the analysis and management of the incident.
Source: Kleine Zeitung