Berlin Refuses to Pay Hackers Who Stole Data From the City's State Network
Berlin refuses ransom demands after Rhysida claimed stealing 5.79 TB from the city-state network, including mobility department data on 12,076 individuals.
Berlin's state government confirmed an extortion attempt following the August compromise of its state administrative network and said it will not pay. Forensics found data exfiltrated from the Senate Department for Mobility, Transport, Climate Protection and Environment between August 7 and 12, 2026; Rhysida's leak site claims 5.79 TB, 1.44 million files, and personal data on 12,076 individuals. State criminal police, prosecutors, and federal authorities are investigating, and officials say the September 20 Abgeordnetenhaus election environment remains unaffected. Separately, Manchester Airports Group confirmed theft of customer data including emails, phone numbers, and vehicle registrations across three airports.
- Rhysida listed 'Berlin, Germany' on its leak site August 28, claiming 5.79 TB and 1.44 million files
- CISA/FBI/MS-ISAC advisory documents Rhysida initial access: valid VPN accounts, Zerologon, phishing
- Housing benefit applications were down while two departments were isolated; all reconnected August 23
- Rhysida has 280 listed victims, including Stuttgart city administration and Welthungerhilfe
- Vice Society (Microsoft: Storm-0832) overlap with Rhysida was noted by Check Point in 2023
- CVEs
- CVE-2020-1472
- ATT&CK
- T1133 External Remote ServicesT1078 Valid AccountsT1068 Exploitation for Privilege EscalationT1566 Phishing
- Vendors
- MicrosoftCheck Point
- Products
- Netlogon Remote ProtocolVPN
- Threat actors
- RhysidaVice SocietyStorm-0832
- Organizations
- CISAFBIMS-ISACBSIDer SpiegelThe Hacker News
- Countries
- GermanyUnited States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2020-1472 | Unauthenticated Privilege Escalation (Zerologon) in Microsoft Netlogon Domain Controllers | 5.5 | 99% | KEVRansomwarePoC | KEV |
From the original article
5 min read at thehackernews.com
Berlin's state government has confirmed that it is the target of an extortion attempt following the August compromise of the city's state administrative network, and said it will not meet the extortionists' demands.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.