Berlin Investigates Newly Published Data From Breach Affecting Two Ministries
Summary
Berlin is investigating newly published data, including login credentials, after a breach disrupted two ministries. Officials confirmed data theft and an extortion demand but have not verified Rhysida’s claims about the stolen data.
Key points
- The breach, discovered in mid-August, affected Berlin’s urban development and transport ministries; their systems were disconnected from the wider government network on Aug. 14.
- Newly published data includes login credentials. Officials have not said what systems they could access or whether the credentials remain valid.
- Berlin’s data protection authority said stolen files include personal information about public employees; residents’ data may also have been exposed.
- Rhysida claimed responsibility and said it stole 5.79 terabytes of data, but Berlin has not attributed the attack to the group or verified its claims.
- Berlin confirmed an extortion demand and said it would not pay. Authorities are reviewing the files and working to identify affected people.
- Separately, Germany’s BSI warned of a campaign involving fake CAPTCHA pages that trick visitors into running malicious commands, with attempted data theft and ransomware deployment.
- The BSI associated the separate campaign with LoremIpsumLoader, also known as AxolotLoader, and said it had found no link to state-sponsored or politically motivated actors.
Article Details
- Victim Organization
- State of Berlin government, including two ministries
- Incident Type
- Ransomware-related cyberattack and data breach
- Data Types Exposed
- Login credentials
- Names
- Addresses
- Dates of birth
- Bank information
- Email addresses
- Telephone numbers
- Correspondence with government agencies
- Copies of documents submitted to the administration
- Affected Records
- Not disclosed
- Affected Data Size
- Rhysida claimed 5.79 terabytes; Berlin has not verified the amount or contents.
- Operational Impact
- Affected systems were disconnected from the wider government network on Aug. 14. Both ministries continued operating, but some employees lost normal email and internet access, and public services dependent on the systems were temporarily affected.
- Ransom Or Extortion
- Berlin confirmed receiving an extortion demand and said it would not pay. Rhysida claimed responsibility and threatened publication of stolen data.
- Claim Status
- confirmed
MITRE ATT&CK
People
Florian HauerBerlin Chief Digital Officer who said the city would not be blackmailed.Iris SprangerBerlin Interior Senator who said authorities had found no evidence that election systems were affected.Kai WegnerBerlin Governing Mayor who said authorities were working to identify and assist people whose information had been exposed.