Berlin Refuses to Pay Hackers Who Stole Data From the City's State Network
Berlin refuses ransom demands after Rhysida claimed stealing 5.79 TB from the city-state network, including mobility department data on 12,076 individuals.
Berlin's state government confirmed an extortion attempt following the August compromise of its state administrative network and said it will not pay. Forensics found data exfiltrated from the Senate Department for Mobility, Transport, Climate Protection and Environment between August 7 and 12, 2026; Rhysida's leak site claims 5.79 TB, 1.44 million files, and personal data on 12,076 individuals. State criminal police, prosecutors, and federal authorities are investigating, and officials say the September 20 Abgeordnetenhaus election environment remains unaffected. Separately, Manchester Airports Group confirmed theft of customer data including emails, phone numbers, and vehicle registrations across three airports.
- Rhysida listed 'Berlin, Germany' on its leak site August 28, claiming 5.79 TB and 1.44 million files
- CISA/FBI/MS-ISAC advisory documents Rhysida initial access: valid VPN accounts, Zerologon, phishing
- Housing benefit applications were down while two departments were isolated; all reconnected August 23
- Rhysida has 280 listed victims, including Stuttgart city administration and Welthungerhilfe
- Vice Society (Microsoft: Storm-0832) overlap with Rhysida was noted by Check Point in 2023
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-1472 | Unauthenticated Privilege Escalation (Zerologon) in Microsoft Netlogon Domain Controllers CVE-2020-1472, widely known as "Zerologon," is an elevation-of-privilege flaw in how the Netlogon secure channel is established over the Netlogon Remote Protocol (MS-NRPC) on Microsoft domain controllers. An unauthenticated attacker with network reachability to a domain controller sends specially crafted Netlogon messages to establish a vulnerable secure channel and then runs a specially crafted application on the network to obtain domain administrator access. Successful exploitation yields domain administrator privileges, effectively full compromise of the Active Directory environment, and the flaw is known to be used in ransomware operations. Any organization running affected Windows Server versions (2008 through 20H2) as domain controllers is exposed, along with environments using Netlogon implementations from Samba and distributions or products from Fedora, openSUSE, Canonical (Ubuntu), Debian, Synology, and Oracle. Exploitation is highly active: a public Zerologon PoC/exploit is available, the flaw is on CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03, with known ransomware use), and EPSS estimates a 99.4% probability of exploitation within 30 days. Do: Apply the vendor updates on all domain controllers and other affected systems immediately, following Microsoft's two-phase Netlogon secure channel guidance (the enforcement phase of the phased rollout began in Q1 2021). Audit Netlogon secure-channel connections and event logs for clients still using vulnerable connections before enabling full enforcement, and install updated packages for Samba and other Netlogon implementations from Fedora, openSUSE, Ubuntu, Debian, Synology, and Oracle. Given known ransomware use, prioritize patching any domain controller reachable from user networks, VPNs, or the internet. | 5.5 | 99% | KEV ransomware PoC |
| massmillions of domain controllers worldwide (essentially every Active Directory domain), with hundreds of thousands of domain controllers/RPC endpoints… |
Full article1,080 words · extracted from thehackernews.com · click to collapse
Berlin's state government has confirmed that it is the target of an extortion attempt following the August compromise of the city's state administrative network, and said it will not meet the extortionists' demands.
The same statement disclosed that forensic work had found further data outflows in the portfolio of the Senate Department for Mobility, Transport, Climate Protection and Environment, with the exfiltration dated between August 7 and August 12, 2026.
Scope and content are still being examined, and the Senate Chancellery said personal or other non-public data cannot be excluded from what was taken.
The department first reported an outflow on August 7, the Senate Chancellery said in response to questions, seven days before it was cut off from the network on August 14.
Berlin has published no figure for how much left the network. The only itemized account in circulation is the attackers' own, a leak-site post indexed on August 28 that claims 5.79 terabytes of data and personal information on 12,076 individuals.
The Senate's two releases on the incident carried no guidance for people whose records may be among the data as of August 29.
"The state of Berlin is being blackmailed," Governing Mayor Kai Wegner said after a special Senate session at the Rotes Rathaus, quoted in the machine-translated English version on Berlin's official city portal.
The Senate Chancellery's statement said that the state criminal police, the public prosecutor, and federal security authorities are investigating the suspected perpetrators and identified no group behind the attack.
Der Spiegel has named Rhysida as the group that first reported the attribution on August 28, citing an entry on the group's darknet leak site and security sources involved in the response. The Hacker News confirmed via a leak-site monitoring service on August 29 that an entry titled "Berlin, Germany" was added to Rhysida's leak site on August 28.
The post claims to have scanned 5.79 terabytes of data and around 1.44 million files, and it identifies the victim only as Berlin, Germany, rather than as the Senate or any department. No ransom figure appeared in the entry, and its eleven file categories, the largest of which is 124,823 maps and geodata files, together account for about a quarter of the claimed total file count.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the Multi-State Information Sharing and Analysis Center (MS-ISAC) set out the group's tradecraft in a joint advisory on Rhysida, which documents the following routes for initial access -
- Valid accounts on external-facing remote services, where the actors authenticate to internal virtual private network (VPN) access points with compromised valid credentials, notably at organizations lacking multi-factor authentication (MFA) enabled by default.
- Zerologon (CVE-2020-1472), an elevation of privileges vulnerability in Microsoft's Netlogon Remote Protocol that Microsoft patched on August 11, 2020.
- Phishing, which the agencies record as a successful route into victim networks.
The advisory dates to November 2023, when the agencies first warned of Rhysida's double extortion attacks. It records that the "FBI and CISA do not encourage paying ransom" because payment does not guarantee recovery and may embolden adversaries to target further organizations.
The agencies recommend prioritizing remediation of known exploited vulnerabilities, enabling multi-factor authentication across services, and segmenting networks to prevent ransomware spreading.
The same document notes open-source reporting of similarities between Vice Society, which Microsoft tracks as Storm-0832, and the actors deploying Rhysida, an overlap with Vice Society that Check Point set out in 2023.
The monitoring service listed 280 Rhysida victims as of August 29, nine of them in Germany, including the Stuttgart city administration in May 2026 and the aid organization Welthungerhilfe in June 2025. Its listings also include the Port of Seattle, which runs Seattle-Tacoma International Airport, indexed in September 2024.
The Senate Chancellery said Berlin's state data protection commissioner and the Federal Office for Information Security (BSI) are being kept informed on a continuing basis. The Hacker News found no statement on the incident from the Berlin Commissioner for Data Protection and Freedom of Information as of August 29.
Interior Senator Iris Spranger said that as things stand, no data left the areas relevant to the conduct of the September 20 Abgeordnetenhaus election, and that her security officers regard the election environment as secure.
Berlin first disclosed the incident on August 17, saying forensic work had established a compromise of the state network and that both affected departments had been isolated since the previous Friday.
At an August 19 press conference, Wegner said the incident was and remains serious, and emphasized that, based on current knowledge, no sensitive data had left the state network.
Housing benefit applications and payments were unavailable while the two departments were off the network. All Senate departments were reconnected on August 23, and forensic work and scanning of the state network continue.
Manchester Airports Group Confirms Customer Data Theft
Manchester Airports Group (MAG), which operates Manchester, London Stansted and East Midlands airports, said on August 27 that an unauthorized third party obtained customer data relating to car park, lounge and Fast Track bookings and in-airport WiFi sign-ups at the three sites.
"At no point has passenger safety or aviation security been compromised," a MAG spokesperson said in the company's published statement, adding that airport operations and customer parking services continue to operate normally.
The data obtained includes email addresses, phone numbers, vehicle registrations and postcodes, and MAG said neither it nor the accessed system holds customers' bank or payment details. MAG's statement describes it only as a system distinct from MAG itself.
MAG's customer information page states that the incident "does not involve operational airport systems" and advises passengers to continue traveling to the airport as usual.
As of August 29, access to the online Manage My Booking service has been suspended as a precautionary measure. Changes to bookings due within the next 72 hours will be handled by customer services on 0208 163 8001, weekdays between 9:00 and 17:00.
A figure of roughly 8.7 million affected customers has circulated widely, sourced to a company spokesperson speaking to the press, and MAG's own materials leave the count unstated.
MAG said it has contacted affected customers directly and pointed them to the U.K. National Cyber Security Center's (NCSC) data breach guidance, advising them to stay alert for suspicious emails, text messages and phone calls.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/08/berlin-refuses-to-pay-hackers-who-stole.html