Berlin investigates new data leak after hackers publish stolen login credentials
Berlin investigates a fresh leak after Rhysida hackers published stolen login credentials; the city refuses to pay the ransom demand.
Berlin confirmed hackers published additional stolen data, including login credentials, from a mid-August cyberattack on two city ministries responsible for urban development/housing and transport/climate. The Rhysida ransomware group claimed the breach in late August, saying it stole 5.79 TB of data including contracts, emails, passwords and classified information; Berlin acknowledged an extortion demand but refused to pay. Berlin's data protection regulator said the leak includes personal data on public employees and possibly residents, such as names, addresses, dates of birth and bank information. Germany's BSI separately linked the campaign to the TerminalFix fake-CAPTCHA technique and the LoremIpsumLoader/AxolotLoader malware tied to financially motivated Rhysida-associated hackers, days before Berlin's Sept. 20 election.
- Rhysida claims 5.79 TB stolen; city officials say Berlin will not be blackmailed.
- BSI ties the campaign to fake-CAPTCHA 'TerminalFix' attacks and LoremIpsumLoader malware.
- Affected systems were isolated from Berlin's government network on Aug. 14.
- Officials say no evidence the city's Sept. 20 election systems were affected.
- Vendors
- Microsoft
- Threat actors
- Rhysida
- Malware
- LoremIpsumLoaderAxolotLoader
- Victims
- Berlin
- Organizations
- BSI
- Countries
- Germany
From the original article
3 min read at therecord.mediaAnother trove of data from Berlin's government has appeared online, authorities said. Germany's information security agency separately warned about the Rhysida cybercrime group.
therecord.media
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.