Berlin’s state administration recently faced a significant cybersecurity incident, leading to an extortion attempt by hackers. Despite this, the government has taken a strong stance, refusing to comply with the attackers’ demands. This firm response follows the August breach of the city’s administrative network.
Details of the Data Breach
Forensic investigations have revealed additional data leaks from the Senate Department for Mobility, Transport, Climate Protection, and Environment, occurring between August 7 and August 12, 2026. The scope of the data exfiltration is under examination, with potential exposure of sensitive personal and non-public information.
The initial breach was reported on August 7, leading to a network disconnection on August 14. Although no official data loss figures were released, attackers claim to have accessed 5.79 terabytes of data affecting over 12,000 individuals, according to a leak-site post dated August 28.
Investigation and Attribution
The investigation is being conducted by Berlin’s state criminal police, public prosecutors, and federal security agencies. No specific group has been officially identified behind the attack, though Der Spiegel has linked the incident to the Rhysida group, confirmed by security sources and monitoring services on August 29.
The hackers purportedly accessed a vast amount of data, including 1.44 million files, but did not specify a ransom amount. U.S. cybersecurity agencies have previously outlined Rhysida’s methods, emphasizing the use of compromised accounts and phishing to gain access to networks.
Preventive Measures and Future Outlook
The agencies involved recommend enhancing security through multi-factor authentication, addressing known vulnerabilities, and network segmentation to mitigate further ransomware threats. Berlin’s data protection authorities are actively monitoring the situation, ensuring ongoing compliance with security protocols.
Despite the breach, Interior Senator Iris Spranger assured that the data related to the September 20 Abgeordnetenhaus election remained secure. As of August 23, affected departments have been reconnected to the network, and cybersecurity efforts continue to safeguard against future incidents.
This breach highlights the critical need for robust cybersecurity measures in public and private sectors alike. As investigations proceed, Berlin remains vigilant in protecting its citizens’ data and reinforcing its digital defenses.
