Hacker group Rhysida publishes 1.4 million records from Berlin administration in darknet
After failed extortion attempt for over two million euros, the group Rhysida has published stolen Berlin administration data in the darknet. The BSI warns of phishing and political manipulation.
BSI raises alarm following darknet leak from Berlin state network
Following a cyberattack on the Berlin state network, a hacker group has published approximately 1.4 million records in the darknet — including personnel files, work references, timesheets and operational documents of public sector employees. As reported by Google News LU DE, the Federal Office for Information Security (BSI) has issued urgent warnings about the consequences of the leak for those affected and society as a whole.
Failed ransom demand, immediate publication
The hacker group Rhysida had demanded 30 Bitcoin from the Berlin Senate — equivalent to approximately two million euros — in exchange for not publishing the stolen data. The Senate refused payment. The deadline expired on Friday afternoon; shortly afterwards, the stolen data appeared in several packages in the darknet. According to rbb, it remains unclear whether all data obtained in the attack have been published.
The cyberattack on the Berlin state network became known in mid-August. In addition to personnel records and evaluations, the published documents also include materials relating to recruitment procedures.
Security-relevant facilities potentially affected
The BSI does not rule out the possibility that the stolen data includes information on critical infrastructure. According to Deutschlandfunk, at least parts of the data are security-relevant and concern facilities that would require special protection in the event of defence — including hospitals, tank storage facilities, emergency power systems and defence contractors.
However, the authority does not assume the attack was politically motivated, but rather driven by "exclusively financial" motives on the part of those responsible.
Warning of disinformation and phishing ahead of Berlin election
The BSI points to the timing in relation to the election of a new House of Representatives in Berlin, scheduled for 20 September. Particularly around elections, there is an increased risk of so-called "hack and leak" operations, in which stolen documents are published at a time favourable to the attacker and potentially placed in a false context.
Furthermore, the BSI warns of an increased threat from phishing attacks, which attempt to obtain further personal data such as passwords or email addresses. Particular caution is recommended for individuals who have had contact with those affected or affected institutions.
Expert accuses administration of gross negligence
IT security expert Manuel Atug made serious accusations against the Berlin administration following the leak. Speaking to news agency dpa, he stated he was "shocked and speechless": "The State of Berlin has acted with gross negligence and deliberately failed to comply with classified information protection requirements." For the storage and processing of documents classified as confidential, there are very strict regulations and multiple security levels that apparently were not sufficiently applied.
Atug is founder of AG KRITIS, an independent working group of 23 experts dealing with the protection of critical infrastructure in Germany. The Berlin Interior Committee had invited him as an expert witness in 2023 and most recently in 2025. He had warned of significant security gaps at that time, according to Atug — now the consequences of the administration's "desolate cybersecurity" had materialised.
Senate initiates data review
The Berlin Senate stated that security authorities are now conducting "intensive data examination". Those affected whose data has been published are to be identified and contacted. Individuals who have evidence that their data has been published or used for criminal activities are requested to file a criminal complaint.
Source: Google News LU DE