Berlin Senate: Rhysida Ransomware Leaks 1.4 Million Government Files

The Rhysida ransomware gang broke into two Berlin Senate departments, stole several terabytes of data and published it on its Tor leak site after the State of Berlin refused to pay a 30 Bitcoin demand (about €2 million, or $2.3 million). Berlin has confirmed the data theft, the extortion attempt and the theft of plaintext passwords. Governing Mayor Kai Wegner has said the state "will not give in to blackmail." Published counts of the leak vary. Rhysida claims 5.79 TB and about 1.44 million files. Der Tagesspiegel, as cited by NSIDE ATTACK LOGIC, and Euronews report 5.26 TB and 1,439,893 files. NSIDE ATTACK LOGIC's own analysis of the downloaded data found 5.25 TB, 1,431,884 files and 150,480 folders. Reports say the leak includes civil defence plans, critical infrastructure documents and files linked to the federal government and the Bundeswehr, so the impact goes beyond the city administration.

What Happened

Two departments were affected: the Senate Department for Urban Development, Building and Housing, and the Senate Department for Mobility, Transport, Climate Protection and Environment. heise reports that both run their own IT and are not directly managed by Berlin's central IT service provider, the ITDZ.

Timeline, assembled from official statements and press reporting:

• Before 7 August: heise reports that the intrusion began "long before" the theft. NSIDE ATTACK LOGIC says the date of initial access has not been made public.
• 7 to 12 August: Berlin officials date the main data theft to this window (SecurityWeek, heise). DW gives a slightly longer window of 7 to 14 August.
• 14 August: The attack is discovered, and both departments are cut off from the state network as a precaution.
• 17 August: The Senate Chancellery announces an "ICT incident in the Berlin state network." A crisis team is set up. The BKA and the Berlin LKA (state criminal police) open investigations, and the BSI (Germany's federal cybersecurity agency) is notified.
• 21 August: Both departments are still offline. Transfer payments are disrupted, and housing benefit cannot be paid to about 50,000 eligible households (heise).
• 28 August: Rhysida adds "Berlin, Germany" to its leak site. Berlin confirms the extortion attempt and says it will not pay.
• 1 September: Senate spokesperson Christine Richter confirms that passwords for some specialist applications were stolen. heise reports that about 12,000 systems are being checked.
• 3 September: The Senate's own press release says Rhysida has put the data up for auction with a minimum bid of 30 BTC, and warns that the data may be published the next day.
• 4 September: Rhysida's countdown expires at about 15:35 and the data is published (Euronews, NSIDE ATTACK LOGIC).

Sources describe the demand in two ways. The press describes it as a ransom. Berlin's 3 September release describes it as an auction with a 30 BTC minimum bid. Both are common Rhysida tactics. BleepingComputer also reports that the group cited possible GDPR violations to put more pressure on the city.

The investigation involves the Berlin LKA, the Berlin public prosecutor, the BSI and other federal security agencies. Because federal and Bundeswehr material is reportedly in the leak, heise reports that the Bundeswehr Operational Command and the National Cyber Defence Centre are also assessing the damage. heise further reports disagreement among Berlin districts over the use of CrowdStrike forensic software during the response.

What Was Taken

Volume (sources disagree):

The difference between the attackers' 5.79 TB and the roughly 5.25 TB that analysts actually counted is common in leak cases. Rhysida's figure is the size it advertised, not a measured count.

Confirmed by Berlin: Large-scale data theft, including personal and non-public information, and plaintext passwords for specialist applications. The Senate's press release says the leak may contain personal data on state employees, residents and companies.

Claimed by Rhysida (not independently verified):

• Personal data on more than 12,000 people, over 16,000 email addresses, about 12,000 phone numbers and 148 IBANs (SecurityWeek, BleepingComputer)
• Personnel files, payroll records, disciplinary case files, records of administrative offences, scanned passports and ID cards, and private data on senior officials
• Plaintext credential lists stored in Office files, database accounts, password vaults and data from payment systems
• Tens of thousands of state contracts, files on ongoing court cases, SQL database dumps and email archives
• More than 3,200 documents marked as non-disclosure agreements
• Bundesrat (Germany's upper house) committee records and security assessments of Berlin's water supply

Reported by media after publication: heise reports civil defence emergency and protection plans, documents about military barracks, detailed plans for water and heating plants, transformer substations, emergency power systems and arms factories, and floor plans of prisons. Euronews reports a folder titled "AG CBRN-Rahmenplanung," which relates to planning for chemical, biological, radiological and nuclear incidents. Euronews also quotes investigative journalist Lars Winkelsdorf, who says the files include LKA investigation documents and federal plans for secure communications in an emergency. These descriptions come from journalists who reviewed the leak. Officials have not confirmed them item by item.

Why It Matters

National security exposure from a city-level breach. Rhysida is a criminal group, not a state actor. Even so, the leak reportedly contains federal and Bundeswehr material, critical infrastructure plans and CBRN planning documents, and anyone can now download them, including foreign intelligence services. CDU defence politician Roderich Kiesewetter told the Süddeutsche Zeitung that the leak "endangers our national security."

Federated IT means federated risk. The two departments ran their own IT outside the central ITDZ. That kind of setup often leads to uneven controls. In this case it apparently included password lists stored in plain Office files.

Real harm to services. The outage stopped housing benefit payments to about 50,000 households. Taking ransomware-hit systems offline as a precaution protects the network, but it also disrupts public services.

Exposure of third parties. NSIDE ATTACK LOGIC notes that the files also contain data on organisations and individuals who worked with the departments. Contractors, suppliers and residents now face phishing, fraud and identity theft risks they had no part in creating.

Analysis takes a long time. NSIDE ATTACK LOGIC points out that downloading a leak this size over Tor, building an inventory and extracting content by file type takes a great deal of time. More than a month after publication, the full extent of the damage is still not known.

The Attack Technique

Berlin has not officially disclosed how the attackers got in, and NSIDE ATTACK LOGIC says the date of initial access is not public. DW reports that an employee unknowingly opened a phishing email. Only DW reports this, and officials have not confirmed it publicly, so treat it as unverified.

The rest of what is known fits Rhysida's usual pattern of double extortion: get in quietly, stay in the network for a while, steal data in bulk, then publish a leak-site listing with a countdown and an auction. heise reports the intrusion started well before the 7 to 12 August theft window, which suggests the attackers had time to explore the network. Berlin confirmed that plaintext passwords were stolen, and the screenshots Rhysida posted suggest those passwords sat in ordinary Office files. That would have made it easier for the attackers to move from one system to another and to reach specialist applications. Rhysida has been active since mid-2023 and regularly targets healthcare, education, state governments and critical infrastructure.

What Organizations Should Do

1. Find and remove plaintext credentials. Scan file shares, SharePoint and mailboxes for password lists in Office, text and CSV files. Move those credentials into a managed vault and rotate them all.
2. Watch for bulk data leaving the network. Exfiltration of several terabytes over several days should trigger alerts. Set baselines for outbound traffic per segment and alert on large, sustained transfers to unfamiliar destinations.
3. Apply the same standard to departments that run their own IT. Any unit outside central IT management should meet the same requirements for MFA, EDR, logging and segmentation, and should be audited regularly.
4. Classify and isolate sensitive planning documents. Critical infrastructure, civil defence and CBRN material should not sit on general administrative file servers. Keep it on separate systems with strict access controls.
5. Harden against phishing. If DW's report is accurate, a single email started this. Use phishing-resistant MFA, sandbox attachments, and make sure staff can report suspicious emails easily and are rewarded for doing so.
6. Prepare for third-party exposure. If you were a contractor or supplier to these departments, assume your contact details, contracts and any NDA material may be in the leak. Rotate any credentials you shared and watch for targeted phishing.

Sources: Data Analysis of the RHYSIDA Hack at the Berlin Senate Departments... | Berlin confirms data theft after Rhysida ransomware attack claims | National security risk: Berlin data leak causes major repercussions... | Berlin Won’t Pay Extortion Group Claiming Data Theft - SecurityWeek | Berlin: Passwords exfiltrated, 12,000 systems scanned heise online | Aktuelle Lage nach dem IKT-Vorfall im Landesnetz Berlin - Berlin.de | Cyberattack in Berlin: 1.4 million files on the dark web | Berlin cyberattack: hackers leak highly sensitive data across dark...