Hacker group Rhysida publishes 5.7 terabytes of Berlin administration data
After a failed ransom demand, the hacker group Rhysida has posted 1.44 million files from Berlin authorities to the dark web. Among them are personnel records, emergency plans and secret communication channels.
Berlin administration after hacker attack: classified documents publicly accessible
The hacker group Rhysida has published approximately 1.44 million files totalling around 5.7 terabytes from the Berlin state network on the dark web. This is reported by the Süddeutsche Zeitung. After the state of Berlin rejected a ransom demand of approximately two million euros, the Senate administration allowed the deadline to pass on Friday evening — whereupon the group released the stolen data.
What was leaked
According to SZ, the published data includes administrative documents such as contracts, protocols and passwords as well as personal information — including addresses, telephone numbers and confidential personnel records. Tagesspiegel also reports rehabilitation documents, medical certificates and sick notes. Furthermore, there were application materials, internal email correspondence and work papers marked as "Confidential". Security-relevant information such as emergency plans and secret communication channels are also said to be among the leaked documents.
The dataset is considered extremely large by the authorities. What other information it contains will only become clear in the coming days.
Who is behind the attack
The hacker group Rhysida has claimed responsibility for the attack. The group has previously been active against various public and private institutions — including the British National Library and the Chilean military. The Federal Office for Information Security (BSI) believes the hack was "exclusively financially motivated".
According to current findings, Rhysida frequently gains network access via so-called phishing attacks: the attackers imitate trustworthy websites or pose as colleagues or administrators by email in order to obtain access credentials. Whether this approach was also used in the Berlin attack will need to be clarified by ongoing investigations.
How the attack unfolded
The attack occurred on 7 August via the Senate administration for Mobility, Transport and the Environment and the Senate administration for Building and Housing. Both authorities operate their own IT systems and are not directly connected to the state-owned IT service centre. Critics view this lack of consolidation of public IT as a security risk.
Initially, Berlin's Senate chancellery stated that only publicly accessible data had been leaked. This assessment later proved to be incorrect. The timing of the attack was also only recognised late.
According to the state of Berlin, there are currently no indications that the state network remains infiltrated. The network connects approximately 600 locations in Berlin, including administrative buildings, fire stations and scientific institutions.
What those affected can do
The Berlin administration intends to inform individuals whose data has been leaked directly, depending on their risk assessment. A dedicated contact point has been set up for employees of the affected administrations. Those affected are called upon to file a criminal complaint with the police.
Berlin's data protection officer recommends updating passwords for administration and online services and monitoring account activity carefully. Since access credentials were also published, remote access to internal systems has been restricted, according to Tagesspiegel. Employees of the affected administrations were unable to log in via VPN from the home office and instead had to come to the office to do so.
Response from federal government and Bundeswehr
The BSI points to a generally elevated threat level. "The BSI explicitly points out that the publication of stolen data can pose various risks for those affected and ultimately for society," a spokesman explained. Particularly in the political sphere, there is a risk of so-called hack-and-leak operations before elections, in which stolen documents are published at a strategically opportune time and may be placed in a false context.
The Bundeswehr is also concerned with the incident. A spokeswoman for the Operational Command stated to the Süddeutsche Zeitung: "The federal government is aware of the data breach. Detailed analysis is currently being carried out by the responsible security authorities at federal and state level." Following analysis of potential security risks, appropriate measures would be taken to safeguard military security. Information exchange between the participating authorities takes place continuously, also via the National Cyber Defence Centre.
IT security experts welcomed the state of Berlin's decision not to accede to the extortion demand. Anyone with dark web access can theoretically search the leaked files — however, this is time-consuming and carries its own risks.
Source: Süddeutsche Zeitung