Berlin: data stolen by the Rhysida group published after refusal to pay the ransom

Berlin chose not to play, undoubtedly at a high price. After the hack that took two Berlin Senate administrations offline in mid-August and the 30 bitcoins demanded by the Rhysida group, the city refused to pay. The sanction fell on September 4, as soon as the ultimatum expired, with 1.4 million files dumped on the dark web and a message that sounds like a calculated provocation. And the story didn't end there.

The promised bag emptying, executed to the letter

Remember the seven day countdown? Rhysida held it to the minute. A few moments after the deadline, the group posted around 1.4 million files online, as detailed by the specialized media IT-Administrator in its analysis of September 5: personnel files, financial and administrative documents, access identifiers. All accompanied by a message that is intended to be mocking, an invitation to “have fun” addressed to snoops on the dark web.

Nothing very original, actually. The British library made the same choice when faced with Rhysida in 2023, and nearly 490,000 files ended up leaking after its refusal. Berlin therefore knew perfectly well what to expect when standing up to the group.

A second data package, confirmed by the Senate Chancellery

Except that the story does not end on September 4. During the night from Saturday to Sunday, the hackers posted online what the Berlin Senate Chancellery itself described as “another data package”, this time focused on access identifiers, as the Berliner Zeitung reported on Sunday evening. The administration of urban development, construction and housing has reviewed and tightened certain security measures already in place, with a risk of occasional restrictions on online procedures, for example applications for housing assistance. The users concerned must be notified on a case-by-case basis.

The Senate remains tight-lipped about the details of the affected procedures. It only confirms that no element shows, at this stage, that the administrative network remains compromised: investigators from the Land criminal police and the Berlin public prosecutor's office, mobilized since the official announcement at the end of August, are continuing their investigations.

The real danger begins now

This is the paradox of a leak of this magnitude: the hacking itself is over, its consequences are only just beginning. Such a volume of authentic names, positions and internal records turns even the smallest future fraudulent email into a precision weapon. Targeted phishing (spear phishing, a fraud attempt tailor-made from real information about the target) no longer needs to improvise, it draws directly from the city's real files.

This is the principle of double extortion, which has become the norm among ransomware groups: stealing the data before encrypting the systems, then threatening to publish it, regardless of whether the machines are restored behind it. A clean backup repairs a server. It does not bring back a file already online. Double punishment, not double protection.

Rhysida, electoral calendar and coincidences that are not coincidences

Add to that the electoral calendar. The election for the Berlin regional parliament takes place on September 20, just two weeks after this second wave of leaks. The authorities say it bluntly, no link has been established between the attack and the vote, the operation remains classified as motivated by money. The fact remains that data stolen for money may very well be used later for other purposes, electoral or not.