Shumaila Aslam
Bureau Chief Pakistan
SNN News Finland
Hackers Release have dumped roughly 1.4 million files stolen from Berlin’s state administration onto the dark web after authorities refused to pay a ransom of about €2 million, turning a ransomware incident into a wider security and political crisis less than a month before the city-state’s election.
What was leaked
The exposed material includes personnel records, performance reviews, job applications, and internal government documents.
Some of the files reportedly contain sensitive information tied to hospitals, fuel depots, emergency power systems, and arms manufacturers.
German media reports and the attacker’s own listing describe a broader haul: nearly 80,000 administrative fine proceedings, more than 46,500 contracts, close to 6,000 files with login credentials, and thousands of personal contact details.
The listing also allegedly includes judicial documents, emergency response plans, and information on critical infrastructure facilities.
One news report noted a leaked folder titled “AG CBRN-Rahmenplanung,” referring to planning for chemical, biological, radiological, and nuclear threat scenarios.
The compromised system, known as BeLa, is a high-speed fiber-optic network that links hundreds of offices across Berlin’s city-state administration and is operated by state IT provider ITDZ Berlin.
Election timing raises tension
The leak landed days before Berlin’s state election on September 20. Germany’s Federal Office for Information Security, BSI, has warned that the stolen data could be exploited for phishing campaigns and “hack-and-leak” operations intended to influence public opinion or create confusion before the vote.
State Senator for the Interior Iris Spranger has insisted that election infrastructure itself was not compromised. Still, the timing has sharpened concerns about how stolen documents could be selectively published or misrepresented during an active campaign period.
Hackers and their demand
The Rhysida ransomware group claimed responsibility and set a one-week countdown to publish the data if payment was not made. They demanded 30 bitcoin, worth roughly €2 million.
The group is thought to operate from Russia and eastern Europe and was behind a previous attack on the British Museum in 2023, where it published stolen files after the UK institution refused to pay.
German media say Rhysida also attacked the state capital Stuttgart with a very similar pattern.
Berlin’s Governing Mayor Kai Wegner said the city will not pay. On Friday, the group released the files after an auction on its dark-web site ended without a buyer.
The city described the incident as “an extremely serious crime” and an attack on the state itself, urging the public not to spread unverified claims on social media.
Why this matters
Government officials are treating the breach as a major cyber event, with a central crisis unit reviewing the leaked material and notifying affected citizens and businesses under EU data protection rules. State police, prosecutors, and federal security services are investigating with high urgency.
Beyond Berlin, the breach has wider implications. Hospitals, energy operators, manufacturers, and other organizations referenced in the documents may face targeted phishing and impersonation attempts.
The BSI warning points to a broader pre-election threat environment, and security teams across Europe are watching how quickly the leaked data is weaponized.
Under EU data protection rules, authorities must notify affected individuals once the scope is understood, and Berlin has said relevant departments will contact those impacted in line with GDPR requirements.
FAQs:
Who carried out the attack?
The Rhysida ransomware group is reported behind the breach.
How large is the leak?
Reports cite roughly Hackers Release1.4 million files.
Did Berlin pay the ransom?
No. Berlin’s mayor said the city will not be blackmailed.
What is the election risk?
BSI warns the data could be used for phishing and manipulation before the September 20 state election.
Verification
This story is sourced from BBC News, Reuters, The Berliner, AA, TMC Insight, and Euronews. No invented facts or URLs were used. All dates, figures, and attribution are preserved from those sources.
Verified by Scandinavian News Agency Finland
About The Author
