Hacker group Rhysida publishes 1.44 million files from Berlin's state network
After an ultimatum expired, the hacker group Rhysida made stolen data from Berlin's administration publicly accessible. The package comprises 5.26 terabytes of sensitive government data.
Berlin administration data freely accessible online after hacker attack in the Darknet
Nearly three weeks after the attack on Berlin's state network became known, the hacker group Rhysida has posted the stolen data publicly online. According to Google News LU DE, citing the Berliner Morgenpost, a link to a document collection containing approximately 1.44 million files has been available on the corresponding Darknet site since Friday afternoon, 15:36. The message below it reads: "Data hunters, enjoy it."
Scope and content of the data breach
The published package comprises 5.26 terabytes. Rhysida had originally offered a total of 5.79 terabytes of data for sale and demanded at least 30 Bitcoin – approximately two million euros – for it. According to reports, it cannot be said with certainty whether part of the data was sold to criminals beforehand.
The materials included are from the Senate Transport Administration and the Senate Construction Administration: documents on legal proceedings, including lawsuits filed by the German Environmental Aid, information on disaster protection, critical infrastructure, individual transport projects, and personnel records. One subfolder is named "Personnel and miscellaneous". The original hack, which occurred between 7 and 12 August, affected the Senate Administration for Urban Development, Building and Housing as well as the Senate Administration for Mobility, Transport, Climate Protection and the Environment.
Experts warn of high access rights for attackers
Jochim Selzer, spokesperson for the Chaos Computer Club (CCC), believes that a central file storage system of the administration was compromised. "It also appears to be very high access rights," says Selzer. Among these are also personal data of employees such as employment references – "documents that are normally not visible to everyone". Selzer also points out that the state of Berlin may not have complied with applicable rules of the General Data Protection Regulation (GDPR), which in the past has resulted in substantial fines. The CCC advises those affected to file criminal reports.
Politicians demand rapid support for those affected
How many administration employees are actually affected remains unclear. Die Linke and the Greens demand that those affected be identified and supported quickly. Werner Graf, faction leader and top candidate of the Greens, warns that passwords, account data and personal information of tens of thousands could be "used for identity theft and targeted phishing attacks". Tobias Schulze, faction leader of Die Linke, calls for a higher security standard for Berlin's IT.
Senate initially without public response
While the opposition factions sent their statements shortly after the leak, the Berlin Senate remained silent initially. From the Senate Chancellery came word that affected employees would have access to a counselling service. A special unit comprising the State Criminal Police and Senate Transport Administration is investigating and securing data.
In the evening, the Senate issued a further statement: security authorities are conducting intensive data inspections, IT forensics experts are examining the published data at high speed. Affected citizens can contact the Berlin State Data Protection Officer and file criminal reports – via the Berlin Police internet service or any local police station.
Trade union accuses Senate of downplaying
The Police Union (GdP) expresses sharp criticism. State Deputy Thorsten Scheider accuses the Senate of underestimating the scale of the attack. "It cannot be the case that highly sensitive data was stolen here for days and the only response apparently consists of instructing employees to change their passwords. That already shows a certain sense of helplessness. Our colleagues are not to blame for the fact that IT security in the state of Berlin has been driven to the wall for decades."
Rhysida with international attack pattern
On the auction site in the Darknet, there is also an archive with more than 260 entries listing authorities from the USA, Canada, Mexico, Chile and several European countries and healthcare facilities. Data from the network of the city of Stuttgart is also offered there in full and free of charge.
The cyber attack on Berlin was discovered on 14 August. The affected Senate administrations were subsequently isolated from the state network for several days. Initially, the Senate stated that no sensitive data had been leaked. On 28 August, the purchase offer appeared in the Darknet; Governing Mayor Kai Wegner (CDU) declared on the same day that Berlin would not respond to extortion attempts. The incident is now considered the largest IT security breach in the history of Berlin's administration.
Source: Google News LU DE