The consequences of the hacker attack on two Berlin Senate administrations will keep the country's IT technicians busy for some time to come. Digital State Secretary Florian Hauer (CDU) said on Monday afternoon in the Digital Committee of the House of Representatives that the state of Berlin was still busy forensically examining all state and district IT systems. This will check whether the hackers are still hiding in the national network and are capable of further attacks. This investigation will “take a few more days”.
The state administration is also determining how much damage the hackers have caused. They captured more than 1.2 million files with a volume of 5.7 terabytes. They published their loot on the dark web on Friday. On Monday afternoon, the IT technicians were still busy downloading everything.
See F.A.Z. articles more often in your search results
F.A.Z. prefer on Google
Why does the download take so long?
The fact that this takes several days is due to the limited data bandwidth available. The President of the Federal Office for Information Security, Claudia Plattner, told the committee that this was not unusual: the hackers stored the data on illegal servers that were small and “well hidden.” They only allowed data to flow slowly.
Once the experts have downloaded the files, they should be pre-sorted according to their potential explosiveness using artificial intelligence. Administrative staff must then sift through the contents and identify all victims of the data theft. Plattner said this damage assessment will take “a few weeks.”
Through research by journalists on the Darknet, it became known in the past few days that, in addition to employees' personal data, emergency plans to protect critical infrastructure were also stolen. State Secretary Hauer told the committee that files that served “collective security” would be viewed as a priority. He currently does not assume that the “national defense capability” is threatened by the theft.
Probably related to Russia
The hacker collective Rhysida is said to be behind the hacker attack. It first appeared in May 2023. It is not yet clear who is behind it. Due to the sophisticated attack patterns, industry observers believe that Russian hackers are involved. So far, no Russian or Russian-affiliated facilities have been attacked. Half of their previous victims are in the USA, around a quarter of the victims are in Europe.
Rhysida offers hacking software and a service, which is also called Ransomware-as-a-Service (RaaS). RaaS can be rented by cybercriminals. It contains an encryption program that is typically used to hold data digitally hostage: the hackers encrypt the data so that the owners can no longer access it. The data will only be released against a ransom.
Berlin was “lucky in misfortune”
Both Hauer and Plattner in the Digital Committee of the House of Representatives viewed it as a “luck in disguise” that the attack was discovered in Berlin before the hackers had started encrypting. They could only copy the data. They are therefore still available in the Senate administrations.
The hackers still tried to extort a ransom: They demanded thirty Bitcoin, the equivalent of around two million euros. In mid-August they gave the Senate a deadline to pay within a week. Otherwise everything will be published on the dark web. The black-red Senate did not take this into account with the consent of the opposition. The data ended up online on Friday.
Rhysida's blackmail method has already appeared several times: in May 2023 on the servers of the University of Kaiserslautern and shortly afterwards at the American health authority, in autumn 2023 at the British Library and the King Edward VII's Hospital in London. In spring 2026, the Stuttgart administration was affected. In total, around 300 institutions worldwide have been registered that were affected by Rhysida attacks.
At the committee meeting, the digital politicians from all parliamentary groups fundamentally agreed with the Senate's approach. However, representatives of the Greens, Left and AfD demanded to be more fully informed about the extent of the damage.
The left-wing parliamentary group leader Tobias Schulze suggested declaring a major disaster - it gives the state of Berlin more powers over the districts. State Secretary Hauer said that was not necessary. However, the willingness of the districts to cooperate varies.
