Berlin data breach: state refuses to pay extortionists

Berlin has confirmed that the data breach of its state administrative network has turned into an extortion attempt, and the city says it will not meet the extortionists' demands. The confirmation came in a statement from the Senate Chancellery, the body that supports the city's governing mayor, after a special Senate session at the Rotes Rathaus, Berlin's city hall.

The same statement disclosed that forensic investigators found further data outflows in the portfolio of the Senate Department for Mobility, Transport, Climate Protection and Environment, with the exfiltration dated between August 7 and August 12, 2026. Exfiltration means data was copied out of the network without permission. The scope and content of what was taken are still being examined, and the Senate Chancellery said personal or other non-public data cannot be excluded. That department had first reported an outflow on August 7, seven days before it was cut off from the network on August 14.

Berlin has published no figure for how much left the network. The only itemized account in circulation is the attackers' own: a post on a leak site, indexed on August 28, that claims 5.79 terabytes of data and personal information on 12,076 individuals. A terabyte is roughly a thousand gigabytes. The same post claims to have scanned around 1.44 million files and identifies the victim only as "Berlin, Germany", rather than naming the Senate or any department. No ransom figure appears in the entry, and its eleven file categories, the largest of which is 124,823 maps and geodata files, together account for about a quarter of the claimed total file count. As of August 29, the Senate's two releases on the incident carried no guidance for people whose records may be among the data.

"The state of Berlin is being blackmailed," Governing Mayor Kai Wegner said, quoted in the machine-translated English version on Berlin's official city portal. Attribution remains open in Berlin's own account: the Senate Chancellery said the state criminal police, the public prosecutor and federal security authorities are investigating the suspected perpetrators, and that no group behind the attack had been identified. Der Spiegel has named Rhysida as the group, citing an entry on its darknet leak site and security sources involved in the response. The Hacker News, which reported the story this article is based on, confirmed through a leak-site monitoring service on August 29 that an entry titled "Berlin, Germany" was added to Rhysida's leak site on August 28.

The routes those agencies documented are the same doors attackers use against private companies. In a joint advisory on Rhysida published in November 2023, the U.S. Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI) and the Multi-State Information Sharing and Analysis Center (MS-ISAC) set out three ways in: valid accounts on external-facing remote services, where attackers log in to internal virtual private network (VPN) access points using stolen credentials, notably at organizations that do not enable multi-factor authentication (MFA) by default; Zerologon (CVE-2020-1472), a flaw in Microsoft's Netlogon Remote Protocol that lets an attacker raise their privileges inside a network, which Microsoft patched on August 11, 2020; and phishing, which the agencies record as a successful route into victim networks.

MFA means a second proof of identity beyond a password, such as a code from an app. The advisory dates to November 2023, when the agencies first warned about Rhysida's double extortion attacks, a model in which data is both encrypted and stolen and the threat to publish it is used as leverage. It records that the FBI and CISA "do not encourage paying ransom", because payment does not guarantee recovery and may embolden adversaries to target further organizations. The agencies recommend prioritizing remediation of known exploited vulnerabilities, enabling multi-factor authentication across services, and segmenting networks to prevent ransomware from spreading. The same document notes open-source reporting of similarities between Vice Society, which Microsoft tracks as Storm-0832, and the actors deploying Rhysida, an overlap that Check Point set out in 2023.

Rhysida's reach is broad. The monitoring service listed 280 Rhysida victims as of August 29, nine of them in Germany, including the Stuttgart city administration in May 2026 and the aid organization Welthungerhilfe in June 2025. Its listings also include the Port of Seattle, which runs Seattle-Tacoma International Airport, indexed in September 2024.

Not everything about Berlin is settled. Interior Senator Iris Spranger said that, as things stand, no data left the areas relevant to the conduct of the September 20 Abgeordnetenhaus election, the city's state parliament vote, and that her security officers regard the election environment as secure. The Senate Chancellery said Berlin's state data protection commissioner and the Federal Office for Information Security (BSI) are being kept informed on a continuing basis, and The Hacker News found no statement on the incident from the Berlin Commissioner for Data Protection and Freedom of Information as of August 29. Berlin first disclosed the incident on August 17, saying forensic work had established a compromise of the state network and that both affected departments had been isolated since the previous Friday. At an August 19 press conference, Wegner called the incident serious and said that, based on current knowledge, no sensitive data had left the state network. Housing benefit applications and payments were unavailable while the two departments were off the network; all Senate departments were reconnected on August 23, and forensic work and scanning of the state network continue.

The same period brought a separate disclosure from the United Kingdom. Manchester Airports Group (MAG), which operates Manchester, London Stansted and East Midlands airports, said on August 27 that an unauthorized third party had obtained customer data relating to car park, lounge and Fast Track bookings and in-airport WiFi sign-ups at the three sites. "At no point has passenger safety or aviation security been compromised," a MAG spokesperson said in the company's published statement, adding that airport operations and customer parking services continue to operate normally.

The data obtained includes email addresses, phone numbers, vehicle registrations and postcodes, and MAG said neither it nor the accessed system holds customers' bank or payment details. MAG's statement describes the accessed system only as a system distinct from MAG itself, and its customer information page states that the incident "does not involve operational airport systems" and advises passengers to continue travelling to the airport as usual. As of August 29, access to the online Manage My Booking service has been suspended as a precautionary measure, and changes to bookings due within the next 72 hours are being handled by customer services on 0208 163 8001, weekdays between 9:00 and 17:00.

A figure of roughly 8.7 million affected customers has circulated widely, sourced to a company spokesperson speaking to the press; MAG's own materials leave the count unstated. MAG said it has contacted affected customers directly and pointed them to the U.K. National Cyber Security Center's (NCSC) data breach guidance, advising them to stay alert for suspicious emails, text messages and phone calls.

Both cases come down to ordinary weaknesses rather than exotic tricks. The agencies' advisory names remote access accounts without a second check, an unpatched flaw and a convincing message as the ways in, which is the practical lesson for any organization holding customer records: switch on a second factor for logins, install security updates promptly, and keep systems separated so one compromised machine cannot reach everything else. Businesses that want help covering those basics can look at AEU-I, which provides security-first IT, infrastructure and consulting services.