Ransomware group leaks 1.4 million files from Berlin state government

A cybercriminal group known as Rhysida allegedly broke into the network of Berlin’s state government and exfiltrated 1.44 million files. After an unsuccessful extortion attempt, the group published the stolen data on the dark web.

Rhysida initially shared a small sample of the files on an underground forum and demanded 30 bitcoin, worth around $2.3 million, in exchange for deleting the data. Berlin said it would not negotiate and launched a full-scale investigation, describing the incident as an extremely serious crime and an attack on the state of Berlin.

Berlin is reviewing the leaked files and assessing the damage. A steering unit was established in the Senate Chancellery under Chief Digital Officer (CDO) Florian Hauer to coordinate the review and support the affected Senate administrations in informing affected citizens and companies.

German public broadcaster Tagesschau reported that the archive contains 1.44 million files and totals 5.8 terabytes. The Chaos Computer Club claims it includes sensitive information about the city’s water supply, personal data belonging to administrative staff, employment references, and emergency plans.