Hacker leak: 1.4 million Berlin administration records surface on darknet
The hacker group Rhysida has published around 1.4 million datasets on the darknet following a cyber attack on the Berlin state network. The BSI warns of heightened risks for those affected.
Berlin administration data published on darknet after extortion
Following a cyber attack on the Berlin state network, the hacker group Rhysida has made around 1.4 million stolen datasets accessible on the darknet. According to Tagesschau, these include personnel files, references, performance evaluations, timesheets, operational documents and application procedure documents from employees of the Berlin state administration.
The attack became known in mid-August. The hacker group had demanded a ransom of 30 Bitcoin – equivalent to around two million euros – and threatened to publish the data otherwise. The Berlin Senate rejected the payment. When the deadline expired on Friday afternoon, the stolen data appeared in several packages on the darknet. Whether this represents the full extent of the data seized remains unclear.
BSI warns of political instrumentalisation and infrastructure risks
The Federal Office for Information Security (BSI) expressed alarm and pointed to several possible risk levels. The publication could result in "various risks for those affected and ultimately for society", the authority explained.
The BSI particularly highlighted the temporal proximity to the election of the Berlin House of Representatives on 20 September. Particularly before elections, there is an elevated risk of so-called "hack and leak" operations, in which stolen documents are published at a time favourable to the attacker and may be placed in a false context.
Furthermore, the authority warned that the stolen data might also contain security-sensitive information. According to Deutschlandfunk, parts of the data concerned facilities that would require special protection in the event of defence – including hospitals, fuel storage depots, emergency power systems and defence contractors. However, the BSI itself does not assume politically motivated background, but rather "exclusively financial" motives on the part of the perpetrators.
Wegner: payment would have guaranteed nothing
Berlin's governing mayor Kai Wegner (CDU) defended the Senate's decision not to pay. In Bild-Zeitung, he stated: "Who can say that if we had paid, the data would not already be somewhere else?" Currently, a review is being conducted into which information has leaked in order to rapidly inform those potentially affected.
The federal government is also currently conducting an intensive review of its own data systems, according to a spokesman. These were "not affected, according to current knowledge".
IT expert accuses Berlin of gross negligence
Following the leak, IT security expert Manuel Atug levelled serious accusations against the Berlin administration. When speaking to the news agency dpa, he said he was "shocked and speechless": "The state of Berlin acted with gross negligence and deliberately failed to comply with classified information protection requirements." Strict regulations and multiple security levels apply to the storage and processing of documents classified as confidential – these apparently were not sufficiently applied.
Atug is founder of AG KRITIS, an independent working group of 23 experts concerned with protecting critical infrastructure in Germany. The Berlin Interior Committee last summoned him as an expert witness in 2025. At that time, he had warned of serious security gaps – now the consequences of the administration's "dire cyber security" had materialised.
BSI advises heightened vigilance against phishing
The BSI also warned of an elevated risk of so-called phishing attacks following the data leak. In such attacks, criminals attempt to obtain further personal data such as passwords or email addresses through fake messages. According to the authority's assessment, individuals who have been in contact with affected authorities or staff should be particularly vigilant.
Source: Tagesschau