Hacker group Rhysida publishes 5.8 TB of Berlin government data on the dark web
After the deadline expired, the group Rhysida posted the stolen data package to the dark web. The BSI warns of heightened cybersecurity threats ahead of Berlin's election.
Criminal hackers put stolen Berlin data on dark web – BSI sounds alarm
The criminal hacker group Rhysida published approximately 5.8 terabytes of data from the Berlin state network on the dark web around one hour after its deadline expired on late Friday afternoon. According to the Frankfurter Allgemeine Zeitung, the countdown on the extortionists' leak site had expired at approximately 15:35. The perpetrators had demanded 30 bitcoin – equivalent to around two million euros. The Berlin Senate had previously confirmed that it would not accede to such demands on principle.
After the deadline passed, the group declared the "auction" closed on their dark web site. "All files have been uploaded to the publicly accessible area – have fun browsing, data hunters!", the statement read. A link initially led to an error message; approximately one hour later, the data download actually became available.
Experts endorse Senate's stance
The Senate's refusal to comply with the extortion demand met with broad approval in expert circles. Bianca Kastl of the Chaos Computer Club said on RBB Inforadio that the decision was correct. "If you continue to support these groups with money or other things, they will of course just keep doing it", said Kastl. "You have to starve them financially."
IT security expert Christof Fischer pointed out to the German Press Agency that the state is prohibited by law from making payments in extortion cases. He nonetheless described the situation as difficult: "The data is in the hands of criminals, and publication has very damaging effects in many cases." Fischer added that he was not aware of any case in which payment was made and publication did not occur nonetheless. He also assumes that the perpetrators – usually based in Eastern European countries – made the stolen data accessible to authorities there in order to buy protection from investigations.
In comparable attacks, experience shows that it often takes several hours or days before stolen datasets actually become available for download. IT security experts and Berlin investigative authorities continuously monitor the relevant forums and leak sites.
BSI warns of hack-and-leak attack ahead of Berlin election
The Federal Office for Information Security (BSI) points to an elevated threat level. A spokeswoman stated: "The BSI explicitly notes that the publication of stolen data can present various risks for those affected and ultimately for society as a whole." There is a particular danger of so-called hack-and-leak operations in the political sphere ahead of elections, in which stolen documents or emails are strategically released at a time favourable to the attacker and possibly in a false context. A new House of Representatives will be elected in Berlin on 20 September.
The BSI additionally warns of targeted phishing attacks as a result of the data breach. Persons who had been in contact with affected institutions or individuals should be particularly vigilant. Those affected should check whether and to what extent they are affected by the publication and adjust procedures if necessary.
Highly sensitive data stolen
Screenshots and file lists previously published by the hacker group point to substantial loss of sensitive information. The group claims to have stolen around 1.44 million files. These are said to include more than 5,000 personnel files, penalty proceedings and salary statements, as well as confidential documents from Bundesrat committees and vulnerability analyses regarding Berlin's drinking water supply. In addition, the extortionists claimed to have obtained access credentials and passwords in plain text – including for databases of the administration and payment service providers.
Attack known since 14 August
The Berlin administration confirmed the cyberattack on 14 August. Investigators from the State Criminal Police Office (LKA) and the BSI are involved in analysing and managing the incident. The Senate Department for Urban Development, Building and Housing and the Senate Department for Mobility, Transport, Environment and Climate Protection were isolated from the state network for approximately one week as a result of the attack. For days it was not possible in Berlin to apply for or receive housing benefit. Should the data package become fully public, affected authorities, thousands of citizens and employees face considerable data protection and security risks.
Source: Frankfurter Allgemeine Zeitung