Berlin confirms attempted extortion after intrusion into the state administrative network

The Berlin authorities confirmed that the state government has been the subject of an attempt to extort after an intrusion that affected the state administrative network in August. The internal forensic investigation detected leaks of data related to the Senate portfolio for Mobility, Transport, Climate Protection and Environment (exfiltration dated 7-12 August 2026) and said that it cannot be excluded that personal or non-public information is available in the stolen files. The local executive has stated that it will not pay the extortors. At the same time, a leaks site attributed by means and monitoring services to a group known as Rhysida published on 28 August an alleged collection of data that the actor attributes to "Berlin, Germany," indicating 5.79 terabytes and personal data on 12,076 individuals; these figures come from the actor himself and have not been confirmed by the State.

Facts confirmed: The State administrative network was intruded and consequently isolated from departments; the forensic investigation detected data exfiltration activity around the date indicated; the competent authorities - state police, prosecution and federal security agencies - and the Federal Office for Information Security (BSI) and the data protection commissioner have been informed.

Elements still uncertain or reported by third parties: the technical and legal attribution of the attack has not been officially ratified by the Senate; the volume and exact nature of the data extracted - beyond which they may include personal information - are still under review; the figure and detail published by the actor on its leaks site have not been verified by experts independent of the State.

Technically, the campaign fits the modality that US security agencies and response centres have documented for groups such as Rhysida: initial access by valid accounts in exposed services (e.g. VPN link doors) when there is a lack of multi-factor authentication (MFA) protection; exploitation of privilege-raising vulnerabilities in Windows infrastructure (e.g., vulnerability Zerologon, CVE-2020-1472, which allows to compromise domain controllers if not patched); or by phishing to capture credentials. Once inside, the actor makes side movements, adds and compresses relevant data and exfilters them to external servers to demand rescue or to publish them on a filtering site as a "double extortion" tactic. Previous public reports on Rhysida and agency councils such as CISA highlight the recurrence of these techniques and recommend concrete mitigation measures ( CISA - Ransomware Guidance, reference document for defenders).

The specific implications for citizens and organizations are various and practical. For persons whose data may appear in a leak: immediate risk of identity supplanting, e-mail fraud or SMS (phishing / SMiShing), and exposure of sensitive information that could be used for direct extortion. For public administration: loss of confidence, possible legal obligation to notify affected persons according to data protection rules, operational interruptions (e.g. temporary inavailability of services such as housing aid) and costs of forensic response, mediation and communications. At the civic level there is also a political dimension: although the authorities have said that, for now, there is no indication that systems linked to the management of the regional election of 20 September have been compromised, the situation requires continuous monitoring until the experts confirm it.

Actual and likely consequences: In the short term, continued degraded services and increased fraud attempts directed at potentially affected persons; in the medium term, ongoing criminal investigation and possible administrative and financial burden on the State; in the long term, the need to strengthen access controls, network segmentation and credentials management policies to reduce risk of a reincident.

Practical and specific recommendations for particular readers: change critical passwords and activate multifactor authentication (MFA) where possible; distrust emails, SMS or calls that request information or access - especially if they claim to be related to "your case" or public services -; review official notifications and direct communications from the Berlin government before following instructions; monitor bank movements and credit alerts in your country, and consider freezing the credit report if you suspect a risk of identity fraud. If you have received a direct notice from the administration, follow the official instructions and ask through verified channels.

For business and organization leaders, the list of immediate actions includes: preserving records and evidence for forensic research, isolating affected systems, reviewing and strengthening network segmentation, forcing the re-establishment of credentials in accounts with remote access, implementing MFA at all exposed access points, prioritizing the patching of known vulnerabilities (e.g., mitigating CVE-2020-1472 if applied - more technical information in the Microsoft guide on Zerologon CVE-2020-1472), and prepare a clear communication plan for users and regulators. There is no guarantee of recovery after paying a ransom; security agencies recommend not to fund the attackers and to coordinate the response with law enforcement and incident response teams.

With regard to public communication, the authorities should speed up and clarify two key points to reduce collateral damage: to provide a clear list of what types of data (if applicable, by records or services) may have been violated; and to issue practical instructions for those affected, including verification contacts and mitigation steps (for example, where to report fraud attempts). The absence of detailed information increases the exposure of citizens and facilitates phishing campaigns that take advantage of uncertainty.

Finally, although public attribution to a specific actor such as Rhysida appears in press reports and in filtration sites, formal confirmation must correspond to ongoing forensic and judicial investigations. Until these results are public, the volume figures and details of the files published by the alleged attacker should be treated as unverified estimates. What is unanswered is the operational lesson: basic prevention (MFA, patching, segmentation, off-line backup and phishing awareness) remains the most effective defence against this type of aggression; strengthening these measures is the most cost-effective and urgent practical action for both administrations and citizens.