Berlin Data Leak of 1.4 Million Records: Ransomware Exposes Longstanding Failure of Public Protection

According to Deutsche Welle, the Rhysida hacking group infiltrated the Berlin municipal network between August 7 and 14. The intrusion went undetected for more than a week, and the attackers stole about 1.4 million records, including employee files, official correspondence, payroll documents and scanned identity cards. The group then demanded 30 bitcoins, worth about 2 million euros, and threatened to publish the data. Berlin Mayor Kai Wegner said last Friday that the state of Berlin would not give in to blackmail; the data was subsequently posted on the dark web.

The attack began when an employee of Berlin's transport authority replied to a phishing email disguised as routine official business. Rhysida has been active since 2023 and claims to have carried out about 280 attacks worldwide, mainly against US public institutions. It is believed to be based in Eastern Europe. But the real issue is not the attackers' capabilities; it is the fact that such a basic tactic was able to move through Berlin's municipal systems undetected for nearly two weeks.

The leaked information goes far beyond personal privacy. Deutsche Welle's review found that the stolen data includes detailed material on Berlin's critical infrastructure, including combined heat-and-power plants, fuel-storage facilities, emergency power systems, prisons and water-treatment plants. The attackers obtained not only personal information about residents and employees but also technical details about the core nodes that keep the city running. Jochim Selzer of Germany's Chaos Computer Club told the Frankfurter Allgemeine Zeitung: “The more you know about someone, the better you can impersonate them, and the more you can work out—for example—which information you need to place an order in their name.” If organized criminals or foreign intelligence services systematically exploit the data, the consequences could extend from individual fraud to targeted threats against infrastructure.

The more immediate question concerns the government's response. Thorsten Schleheider, deputy chairman of the Berlin police union, criticized years of inadequate data protection in Berlin and said many employees had not received sufficient training. “Highly sensitive data was compromised for days, and the only action that appears to have been taken was to ask employees to change their passwords. That is unacceptable.” Deutsche Welle reported that the Berlin state government had established an interdepartmental coordination office and contacted the Federal Office for Information Security, or BSI. Wegner's promise was to inform, advise and support affected employees and Berlin residents as quickly as possible.

Behind the government's resolute stance that it will not give in are ordinary employees placed at risk: people who worked for years without basic cybersecurity training, whose identity documents, salary information and employment histories have now been bundled onto the dark web. Systemic defensive failure and the exposure of individuals' data form another reality that official rhetoric cannot conceal.

On the electoral front, Stephan Bröchler, head of Berlin's state election commission, told Bild that the September 20 election to the Berlin House of Representatives would not be affected. “At present, none of the systems or processes needed for the election have been affected, including preparations, election day and the publication of preliminary results.” Deutsche Welle also reported that the leaked data included details of an expansion project at the Berlin State Chancellery, indirectly affecting German Chancellor Friedrich Merz of the Christian Democratic Union.