Rhysida Ransomware Group Targets Berlin Government Ahead of Vote
Rhysida ransomware hit Berlin's state government weeks before the September 20 election, claiming 5.79 TB stolen; officials refused the ransom.
Berlin's government confirmed an August cyberattack on its administrative network, with data exfiltrated between August 7 and August 12 and departments isolated on August 17. The Rhysida group claimed responsibility on August 28, alleging theft of 5.79 TB and 1.44 million files including personal data on 12,076 individuals, payroll files, plaintext credentials, and vulnerability analyses of Berlin's water supply. Officials said election systems were not affected and refused to pay; Rhysida has claimed roughly 280 victims since 2023, entering via VPNs without MFA, Zerologon, or phishing.
- Rhysida leak-site entry claims 5.79 TB / 1.44M files from Berlin
- Personal data of 12,076 individuals, 148 IBANs, and plaintext passwords allegedly taken
- Exfiltration detected internally August 7; network isolation only on August 17
- Election on September 20 deemed secure; no election data taken
- Known entry paths: unauthenticated VPNs, Zerologon, phishing
- ATT&CK
- T1133 External Remote ServicesT1068 Exploitation for Privilege EscalationT1566 PhishingT1486 Data Encrypted for Impact
- Products
- GebäudAtlasPAYONE
- Threat actors
- Rhysida
- Victims
- State of Berlin
- Organizations
- CISAFBIBSIMS-ISACBritish Library
- Countries
- Germany
From the original article
3 min read at securityaffairs.com
Berlin ‘s government faces a Rhysida ransomware attack weeks before elections, with officials refusing to pay despite a claimed 5. 79 TB data theft. Berlin’s state government confirmed this week it’s dealing with an extortion attempt following an August cyberattack on the city-state’s administrative network, and officials have already refused the requested ransom.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.