Berlin confirms data theft after Rhysida ransomware attack claims

The ransomware attack affecting Berlin’s state administrative network is particularly significant because it demonstrates how modern ransomware operations have evolved beyond the traditional model of encrypting systems and demanding payment for a decryptor. Berlin has now confirmed that attackers exfiltrated information from parts of the city administration and are attempting to extort the government, while the Rhysida ransomware group has publicly claimed responsibility. The city has made clear that it will not pay the attackers, and investigations involving the Berlin State Criminal Police Office, public prosecutors and federal security authorities remain active. What is still not known with certainty is the complete amount and sensitivity of the stolen information. Rhysida claims to have obtained 5.79 TB consisting of approximately 1.44 million files, but those numbers and the detailed categories published by the attackers should remain classified as threat-actor claims until Berlin’s forensic investigation confirms them.

This distinction between confirmed information and attacker claims is particularly important during ransomware incidents. Extortion groups have a direct financial incentive to exaggerate the sensitivity, volume or strategic importance of what they stole because fear and public pressure strengthen their negotiating position. At the same time, dismissing their claims entirely can also be dangerous because ransomware groups often publish samples proving at least partial access. The appropriate approach is therefore to treat the claims as credible investigative leads while waiting for forensic evidence to establish exactly what systems were accessed, which files were transferred and which individuals or agencies were affected.

Berlin first isolated the Senate Department for Urban Development, Building and Housing and the Senate Department for Mobility, Transport, Climate Protection and the Environment from the state network on August 14 as a containment measure. Subsequent forensic analysis confirmed further data exfiltration from the mobility and environmental administration, with investigators believing the theft occurred before network isolation, likely between August 7 and August 12. The affected departments were later reconnected after security measures were implemented, although Berlin warned that forensic investigations and enhanced monitoring would continue. This sequence highlights an important incident-response principle: containment and recovery do not occur at exactly the same time. Systems may need to return to operation while investigators are still establishing the complete scope of an intrusion.

The decision to disconnect entire government departments from the Berlin state network demonstrates why segmentation and emergency isolation capabilities remain fundamental even in large public-sector environments. When defenders suspect that attackers are moving through interconnected systems, temporarily sacrificing availability may be necessary to protect the wider infrastructure. The resulting disruption reportedly affected administrative workflows, including some permit and application processes that depended upon systems hosted within the disconnected departments. Such disruption is inconvenient, particularly in government services, but allowing an attacker to maintain unrestricted access to the wider state network could have produced substantially greater consequences.

This incident therefore provides another reminder that availability cannot always remain the highest operational priority during an active cyberattack. If continuing normal connectivity enables attackers to expand access or exfiltrate additional information, controlled isolation becomes a defensive tool. Organizations should determine in advance which systems can be disconnected independently, which services depend upon them and what manual or alternative procedures can maintain essential functions while the investigation progresses. Discovering these dependencies during an active ransomware incident makes an already difficult situation considerably worse.

Rhysida’s alleged data inventory is particularly concerning because the group claims to have obtained a broad mixture of government, legal, financial, contractual, personnel, infrastructure, health and mapping information. The attackers also claim that the stolen material includes names, email addresses, telephone numbers, banking information, personnel files, payroll information, administrative-offense records, database dumps, identity documents and internal email archives. More seriously, Rhysida alleges that some of the material contains plaintext credentials, database accounts, password-vault information and credentials belonging to senior officials. None of these detailed categories has yet been fully confirmed publicly by Berlin, but if even a portion proves accurate, the breach could create security consequences extending well beyond the immediate ransomware incident.

Credential exposure would be particularly important because stolen passwords, database accounts or authentication secrets can allow attackers to maintain access even after malware has been removed. This is why incident response following data theft needs to include credential exposure analysis rather than simply rebuilding affected systems. Administrators should determine which authentication secrets were stored on compromised systems, which credentials appeared inside documents or scripts, and whether attackers could have accessed password-management systems or service-account information. Potentially exposed credentials should then be rotated according to risk, and existing sessions or tokens should be invalidated where practical.

Long-lived service accounts deserve special attention. Government networks frequently contain integrations and legacy systems that rely on static credentials embedded in scripts, scheduled tasks or configuration files. Those accounts may not be changed regularly because administrators fear breaking dependent applications. Unfortunately, the same stability that makes them operationally convenient makes them valuable to attackers. If a ransomware group gains access to configuration repositories or administrative documentation, those credentials can provide future access even after the original intrusion has been contained.

Privileged accounts require an even stronger response. If credentials belonging to senior administrators or officials were genuinely present in the stolen material, defenders must assume that the attackers or anyone later obtaining the leaked data may attempt credential reuse, targeted phishing and impersonation. Password changes should therefore be accompanied by phishing-resistant MFA, session revocation and monitoring for unusual authentication behavior. Simply changing a password does not necessarily invalidate every authentication token or API credential associated with an account.

Rhysida’s claim that password-vault information was stolen, if verified, would require particularly careful investigation. Password managers improve security because they centralize strong credentials and reduce reuse, but they also become high-value targets. The risk depends heavily on what exactly was accessed. An encrypted vault protected by a strong independent master password presents a very different problem from exported plaintext password files, unlocked vault contents or administrative recovery material. Investigators therefore need to determine the precise nature of any allegedly stolen password-management information before estimating impact.

The attackers also claim possession of critical-infrastructure security assessments related to Berlin’s water supply. Again, this remains an attacker claim rather than a confirmed fact, but such information illustrates why government data breaches can create secondary security risks. Documents describing infrastructure weaknesses, protective measures, network architecture or emergency procedures may not contain credentials yet can still provide valuable reconnaissance for future attackers. Information that originally existed only to help defenders understand risk can become useful offensive intelligence once stolen.

Sensitive architectural documentation should therefore receive protection comparable to other high-value data. Risk assessments, penetration-test reports and vulnerability reports often contain extremely detailed descriptions of weaknesses, affected systems and remediation priorities. Organizations sometimes store these documents relatively broadly because they do not contain customer data or financial records. From an attacker’s perspective, however, a penetration-test report can be more useful than a customer database because it effectively provides a roadmap of where defenses are weakest.

The same principle applies to network diagrams and configuration documentation. Information about firewall zones, remote-access gateways, server roles, privileged systems or backup infrastructure can dramatically accelerate reconnaissance during a subsequent intrusion. Data classification therefore needs to consider operational sensitivity, not only privacy classifications such as personal information.

Rhysida’s reported reference to government and legal records raises another risk: integrity and trust. The immediate concern in most ransomware incidents is confidentiality because information has been stolen. But attackers with access to administrative networks may also have had an opportunity to modify data. Forensic investigation should therefore determine whether files, database records or configuration information were altered during the intrusion. Data that remains present after an attack cannot automatically be assumed to be trustworthy.

This issue is particularly important in government environments where administrative decisions, legal processes and public records may depend upon data integrity. Restoring services is only part of recovery. Authorities also need confidence that records being used after restoration accurately represent their pre-incident state. File hashes, database transaction histories, trusted backups and immutable logging can assist with that validation.

Berlin has said there is currently no indication that election data was compromised and that the technical environment supporting the upcoming Berlin House of Representatives election is considered secure. That distinction is important because government cyberattacks often produce immediate speculation regarding election interference. Unless forensic evidence establishes such access, the ransomware incident should not be automatically expanded into an election-security narrative. At present, Berlin’s own statements indicate that no relevant election data has been identified as compromised.

Nevertheless, the incident illustrates why election infrastructure should remain separated from broader administrative systems wherever practical. Government networks inevitably contain many departments with different risk profiles. A compromise beginning inside an environmental or urban-development department should not automatically create access to election systems, law-enforcement databases or other highly sensitive functions. Segmentation, independent authentication boundaries and tightly controlled administrative paths reduce the ability of attackers to transform one departmental compromise into city-wide access.

The initial entry method used in the Berlin attack has not been publicly disclosed. This is another area where speculation should be avoided. Rhysida and related operators have previously used a variety of techniques, including phishing, compromised credentials and malicious software delivery, but previous tradecraft does not prove how this specific incident began. The forensic investigation will need to establish the earliest confirmed attacker activity and determine whether the intrusion originated through an internet-facing vulnerability, stolen credentials, social engineering, a compromised endpoint or another mechanism.

That root-cause analysis matters because remediation depends upon it. If attackers entered through a vulnerable internet-facing appliance, patching and exposure management become central. If the initial compromise involved credentials, identity controls and MFA need scrutiny. If social engineering succeeded, help-desk verification and user awareness become relevant. Rebuilding affected servers while leaving the original entry path intact creates the possibility of immediate reinfection.

The attack also reinforces why government organizations need comprehensive logging. Investigators must reconstruct activity that occurred days or potentially weeks before detection, which requires authentication, endpoint, firewall, application and network telemetry covering the entire relevant period. Logs retained only locally on compromised systems may be unreliable because attackers can delete or alter them. Critical security telemetry should therefore be forwarded into protected centralized infrastructure where compromised endpoints cannot rewrite historical evidence.

Network flow records can be especially useful when investigating data exfiltration. Moving terabytes of information should generate substantial network activity somewhere, although attackers may compress data, distribute transfers over several days or use legitimate cloud platforms to make the traffic appear less unusual. Monitoring should therefore identify deviations from normal outbound behavior rather than relying only on absolute transfer thresholds.

A departmental file server that normally sends minimal data to the internet suddenly transferring hundreds of gigabytes externally should generate immediate investigation. Likewise, servers that ordinarily communicate only with known government or vendor destinations should not freely establish connections to arbitrary hosting providers or newly registered domains. Egress controls and anomaly detection can make large-scale data theft significantly harder.

This is another reason outbound firewall policy deserves as much attention as inbound protection. Traditional security architectures concentrate heavily on preventing outsiders from connecting into the network while allowing broad outbound access. Modern ransomware operators take advantage of this by establishing command-and-control sessions and transferring stolen data through connections initiated from inside the victim network. Restricting unnecessary outbound connectivity can prevent one compromised host from communicating freely with attacker infrastructure.

Application-aware controls can improve this further. Allowing TCP port 443 to the entire internet is not equivalent to allowing approved business applications to reach known services. HTTPS can carry web browsing, cloud APIs, file transfers, remote administration and encrypted attacker tunnels. Effective egress control therefore needs contextual understanding rather than simple port-based rules.

Data Loss Prevention can provide another layer, particularly for government repositories containing personal or non-public information. However, DLP should focus on context rather than producing alerts every time sensitive information appears. Administrators legitimately handle personal, payroll and financial information every day. The stronger signal is an unusual identity accessing an unusually large quantity of sensitive information and transferring it toward an unusual destination.

Behavioral correlation becomes particularly important. A newly authenticated account accessing several file servers, compressing large volumes of documents and then sending data to an unfamiliar external host creates a much stronger indicator than any single event considered independently. User and entity behavior analytics can help surface these combinations, though they need careful tuning to avoid overwhelming analysts.

The attack also demonstrates why ransomware must now be understood primarily as an extortion business rather than an encryption technology. Rhysida is attempting to pressure Berlin through threatened publication of stolen information. Whether or not files on Berlin systems were encrypted is therefore only one part of the incident. Once information leaves the network, backups cannot solve the problem. The city may restore every affected system successfully while the attacker still possesses copies of sensitive information.

This has fundamentally changed ransomware defense. For years, organizations were told that robust backups were the best defense against ransomware. Backups remain essential for availability and recovery, but they provide little leverage against data theft. Modern ransomware resilience requires preventing and detecting exfiltration, limiting access to sensitive repositories and reducing the amount of data that can be stolen through a compromised identity or system.

Data minimization becomes relevant here. Government agencies are required to retain many records for legal or administrative reasons, but duplicate files often accumulate across shared drives, email archives, employee workstations and departmental storage. Every unnecessary copy increases the amount of material attackers can access. Organizations should know which information they hold, why it is retained and where authoritative copies reside.

Email archives are particularly valuable to attackers because they combine sensitive attachments with contextual information about relationships, projects and internal decision making. If Rhysida’s claim regarding email archives proves accurate, criminals could use that information for sophisticated follow-on phishing. An attacker who knows the names of officials, current projects and recent discussions can construct messages significantly more convincing than ordinary generic phishing.

This means post-breach security should include warning employees and external partners about targeted impersonation. Attackers may pretend to be government officials, contractors or known colleagues and reference genuine stolen information to build credibility. Sensitive requests involving payments, passwords, document sharing or account changes should therefore be independently verified even when the message contains accurate contextual details.

IBAN exposure, if confirmed, creates similar fraud possibilities. Banking identifiers alone do not normally allow direct withdrawal of funds, but when combined with invoices, contracts and supplier information they can support payment-redirection fraud. Attackers may impersonate a supplier or government employee and request that future payments be redirected to a different account. Finance departments need strong out-of-band verification procedures for banking changes precisely because stolen business documentation can make fraudulent requests appear authentic.

HR information creates another long-term risk. Payroll records, personnel files and identity documents may support identity theft, targeted phishing or extortion against individual employees. Government workers whose information is confirmed as affected may therefore need monitoring and notification long after technical systems have been restored.

This is why breach impact needs to be measured over two timelines. Operational disruption may last days or weeks, while privacy and identity risks can persist for years. A server can be rebuilt quickly. A stolen identity document or sensitive personnel record cannot be recalled from the attacker.

The incident also reinforces the importance of privileged-access segmentation. Administrators maintaining government infrastructure should use separate privileged identities and ideally dedicated administrative workstations rather than performing privileged tasks from ordinary user endpoints. If an employee device becomes compromised, the attacker should not automatically inherit credentials capable of accessing broader network infrastructure.

Tiered administration can reduce this risk by ensuring that domain-level credentials are never exposed to lower-trust systems. Privileged accounts should also have limited internet access so credentials and sessions cannot easily be harvested through ordinary browsing or email activity.

Service accounts deserve similar segmentation. They should have narrowly defined permissions and should not possess interactive login capability unless genuinely necessary. Long-lived credentials should be rotated regularly, and systems should move toward managed identities or short-lived authentication mechanisms where available.

The government’s response also demonstrates the value of external coordination. Berlin has involved the BSI, law enforcement, prosecutors and data-protection authorities. Large ransomware incidents often exceed the capabilities of one internal IT department because they involve technical forensics, criminal investigation, privacy obligations, public communications and potentially national-security considerations.

Organizations should establish these relationships before an incident. Knowing which authorities, cyber-insurance providers, forensic specialists and legal advisers need to be contacted reduces delay when an attack occurs. Incident-response plans should contain current contact details and clearly defined escalation criteria rather than depending upon someone finding the right telephone number during a crisis.

Communication discipline is equally important. Berlin has publicly distinguished between what is known and what is still being investigated. That approach is preferable to prematurely announcing a specific number of affected records and later repeatedly revising it. Early forensic findings are often incomplete, and attackers themselves may exaggerate.

The government’s explicit refusal to pay the attackers also removes uncertainty around its public negotiating position. Paying ransom remains controversial because it may sometimes help an organization recover operations or delay data publication while simultaneously financing criminal ecosystems and providing no guarantee that stolen information will actually be destroyed. Attackers can retain copies regardless of promises made during negotiation.

For public institutions, the issue is even more complicated because ransom payments involve taxpayer money and potentially legal or sanctions considerations. Berlin’s position makes clear that its response will focus on containment, investigation and recovery rather than relying on an attacker’s promise to delete data.

This should not, however, be confused with assuming that refusing payment eliminates the consequences of data theft. If Rhysida publishes stolen material, Berlin may need to deal with privacy exposure, credential compromise and sensitive document dissemination independently of its ransomware recovery process.

Organizations should therefore prepare for the possibility of public leakage during incident response. Security teams need to coordinate with legal, communications and privacy teams to identify sensitive information appearing on criminal leak sites and determine which stakeholders require notification.

The attackers’ reported use of GDPR consequences as extortion leverage is another interesting development. Ransomware groups increasingly reference regulatory penalties when pressuring European victims, essentially arguing that paying the criminals may be cheaper than suffering privacy fines or litigation. This is manipulative for obvious reasons, but it demonstrates that attackers understand the regulatory environment of their victims and incorporate it into extortion strategy.

Organizations should never interpret this as a reason to pay. Regulators generally evaluate whether appropriate security measures and notification procedures were followed, not whether criminals successfully frightened the organization into transferring cryptocurrency. Strong governance, prompt containment and transparent cooperation with authorities provide a much more defensible response.

The incident should also prompt public-sector organizations to review third-party connectivity. Government networks frequently rely on contractors, engineering firms, software suppliers and managed service providers. Each trusted connection can become an intrusion path if the partner is compromised. Segmentation should therefore apply to suppliers as well as internal departments, with access restricted to specific systems and business requirements.

Zero Trust architecture is particularly relevant here. A device or account should not receive unrestricted access merely because it is connected to a government network. Every access request should be evaluated according to identity, device state, resource sensitivity and business purpose. Compromise of one department should therefore encounter additional authorization boundaries before reaching unrelated government systems.

Zero Trust does not mean eliminating networks or firewalls. The Berlin incident demonstrates why both identity and network controls are necessary. Network isolation successfully contained affected departments while forensic work continued. Identity controls can further restrict what individual compromised accounts can access inside those network segments.

Backup architecture remains important even in a data-theft-focused incident. Attackers may attempt to destroy recovery systems while exfiltrating information, and ransomware groups often combine theft with encryption. Backups should therefore be isolated from ordinary administrative credentials and protected against deletion or modification by compromised production systems.

Immutable or offline backups provide stronger assurance than backup files residing on storage accessible by the same administrators managing production servers. Recovery procedures should also be tested regularly. An organization does not truly possess a backup strategy until it has demonstrated that critical services can actually be restored from those backups under realistic conditions.

The Berlin incident also provides a useful reminder that recovery needs heightened monitoring. The affected departments were reconnected after security measures were applied, but Berlin continues enhanced monitoring and forensic analysis. This is appropriate because attackers sometimes retain persistence that becomes visible only after normal operations resume.

Reconnection should therefore occur gradually, with strict monitoring of authentication, endpoint behavior and network connections. Systems should not simply return to their previous trust relationships immediately after rebuilding.

Threat hunting should continue across the wider network even when initial evidence suggests containment. The fact that two departments were identified as affected does not automatically prove that attackers never reached another segment. Investigators should search for common indicators, unusual authentication patterns and communications with attacker infrastructure across all relevant systems.

The unknown initial access mechanism makes broad hunting particularly important. Until investigators understand how the attackers entered, defenders cannot confidently identify every potentially exposed system. Root cause is therefore part of containment, not merely an academic question for the final incident report.

The incident ultimately demonstrates that ransomware defense has become an exercise in limiting blast radius. It may be unrealistic to guarantee that every government employee, endpoint and application will never be compromised. The more practical objective is ensuring that compromise of one user or department does not provide access to the entire administrative network and millions of files.

Segmentation limits where attackers can move. Least privilege restricts what compromised identities can access. Egress controls make data theft harder. Centralized telemetry increases detection. DLP identifies abnormal sensitive-data movement. Privileged-access management protects high-value credentials. Immutable backups preserve recovery capability, and rehearsed incident-response procedures reduce the time required to isolate affected systems.

No single one of these controls prevents every ransomware attack. Their combined effect determines whether an attacker compromises one workstation, one department or an entire government network.

The Berlin incident also shows that cyber resilience must include the ability to continue public services under degraded conditions. When departments were disconnected, administrative processes experienced delays and limitations. Governments cannot simply shut everything down indefinitely. Business continuity plans therefore need secure fallback procedures for essential services while affected technology is unavailable.

Paper-based or isolated emergency procedures may seem unfashionable in highly digitized environments, but resilience sometimes depends upon maintaining ways to operate without the primary IT system. Digital transformation should not inadvertently create a situation where one cyber incident makes basic government functions impossible.

The most important point at this stage is that Berlin’s investigation remains ongoing. The city has confirmed data exfiltration and extortion, but the complete contents and scale of the stolen information have not yet been established. Rhysida’s 5.79 TB figure and extensive list of allegedly stolen information should therefore not be repeated as confirmed breach facts.

What is already confirmed is serious enough. Attackers penetrated part of a major European capital’s administrative network, information left the environment before containment, multiple government departments had to be disconnected, some public administrative processes were disrupted and criminals are now attempting to use the stolen data as leverage.

That should be sufficient to draw the broader security lesson without exaggeration.

Ransomware is no longer primarily an encryption problem. It is an access problem, an identity problem, a network-segmentation problem and increasingly a data-governance problem. By the time the ransom demand appears, attackers may already have spent days exploring the environment and copying information.

The most valuable defensive opportunities therefore occur before encryption and before the leak-site announcement: detecting unusual identity activity, limiting lateral movement, monitoring bulk data access, controlling outbound connections and responding aggressively to indications of compromise.

Berlin’s decision to isolate affected departments appears to have contained the incident before it spread further through the state network. The remaining challenge is determining exactly what the attackers accessed during the period before isolation and ensuring that stolen credentials, sensitive documents or other information cannot be converted into a second attack later.

That final point is particularly important. A ransomware incident does not necessarily end when the malware is removed or systems reconnect to the network. Stolen information can remain useful to attackers for months or years. Security recovery therefore needs to address not only what happened inside the network but also what the attackers may now possess outside it.

For Berlin, the technical recovery may already be progressing. The longer-term security work is establishing precisely what information left the network, reducing the usefulness of any stolen credentials, notifying affected individuals where required and strengthening segmentation and monitoring so that another compromise cannot travel as far.

That is the broader lesson for every large organization watching this incident. The objective is not merely to build a network that attackers cannot enter. That is an increasingly unrealistic promise. The more achievable and arguably more important objective is to build an environment where an attacker who does get in discovers that sensitive data, privileged identities and unrelated systems are still protected by additional boundaries.

Ransomware groups make money when one initial compromise becomes access to everything. The architecture should make sure it does not.

Berlin's city administration has confirmed that cybercriminals are attempting to extort the city after the Rhysida ransomware gang listed it on their data leak site. [...]

Source: Berlin confirms data theft after Rhysida ransomware attack claims via Bleeping Computer — published 31 Aug 2026.