Berlin Investigates Rhysida Data Theft Claims and Refuses to Pay
Summary
Berlin is investigating Rhysida’s claim that it stole 5.79 TB of data. Investigators report exfiltration from a Senate department, but the extent is unknown; officials say election systems remain secure and refuse to pay.
Key points
- Rhysida claimed it stole 5.79 TB across about 1.44 million files and threatened to publish the data unless Berlin paid.
- Berlin Mayor Kai Wegner said the city would not pay; state and federal authorities are investigating.
- Forensic investigators say data was exfiltrated from the Senate Department for Mobility, Transport, Climate Protection and the Environment, likely between August 7 and 12.
- Affected Senate departments were disconnected from the state network on August 14; investigators say the extent of the theft has not been determined.
- The claimed data includes personal, financial, government and infrastructure records, but the list comes from the attackers and has not been independently verified in the article.
- Officials report no evidence that election data was compromised and consider the technical environment for the upcoming Berlin election secure.
- The method of initial access has not been disclosed.
Article Details
- Victim Organization
- Berlin city administration
- Incident Type
- Ransomware attack, data theft, and extortion
- Data Types Exposed
- Government, legal, financial, contractual, HR, infrastructure, health, and mapping records
- Names, email addresses, and phone numbers
- IBANs and other banking information
- Plaintext credentials, database accounts, payment-system data, password vaults, and credentials belonging to senior officials
- Personnel files and payroll information
- Administrative-offense records and documents related to disciplinary proceedings and other named cases
- Email archives and SQL database dumps
- Identity documents
- Allegedly classified or sensitive government material, including Bundesrat committee records and information about handling classified documents
- Critical-infrastructure security assessments concerning Berlin’s water supply
- Documents marked as nondisclosure agreements
- Affected Records
- Rhysida claims the data comprised approximately 1.44 million files; the extent of the theft remains under investigation.
- Affected Data Size
- Rhysida claims to have exfiltrated 5.79 TB of data.
- Operational Impact
- Affected Senate departments were disconnected from the state network on August 14. Investigators are assessing the breach and exposure across multiple departments. Officials reported no evidence that election data was compromised and considered the technical environment for the upcoming Berlin House of Representatives election secure.
- Ransom Or Extortion
- Berlin officials confirmed an extortion attempt and refused to pay. Rhysida threatened to publish the allegedly stolen files unless the city paid within four days, using alleged GDPR violations as leverage.
- Claim Status
- confirmed