Hacker attack on Berlin administration: Massive data publication on the darknet

After a hacker attack on the Berlin state administration, the extent of the data leak and the consequences of publishing large amounts of data on the darknet are gradually becoming known. Around two weeks before the House of Representatives election, the opposition is accusing the black-red Senate of poor crisis management. The IT expert Manuel Atug also makes serious allegations.

“The state of Berlin acted with gross negligence and intentionally did not comply with the secrecy requirements,” Atug told the German Press Agency. “I am really shocked and speechless about this.” There are very strict and precise regulations as well as several security levels for the storage and processing of secret documents. Apparently these were not applied sufficiently.

Atug is the founder and spokesperson of AG Kritis, an independent working group that deals with critical infrastructures. He works as a security consultant for critical infrastructure. Critical infrastructure refers to all those areas whose impairment or failure can lead to supply bottlenecks, disruptions to public safety and other dramatic consequences. These include, for example, energy, information technology, transport, traffic, health, water, nutrition, finance and insurance, government and administration as well as media.

“You don’t have good cybersecurity”

Atug said that he had been invited twice as an expert to the Berlin Interior Committee, in 2023 and 2025. At that time, he pointed out glaring security gaps to those responsible: “You practice desolate cybersecurity. You urgently need to take care of your security processes.” He warned that neglecting security would have serious consequences. “That’s exactly what has happened now,” said the expert.

After a cyber attack on the Berlin administration, around 1.44 million files with a size of 5.8 terabytes were published on the dark web on Friday. The criminal hacker group Rhysida had withdrawn the data unnoticed in mid-August and demanded a ransom of 30 Bitcoin - the equivalent of around two million euros. The Senate did not pay the ransom.

Berlin's Governing Mayor Kai Wegner (CDU) told “Bild” that they were examining what information had been leaked. The aim is now to quickly identify and inform those who may be affected. “We are trying to reach those affected as quickly as possible.”

Data on power plants and defense companies published?

The “Tagesspiegel” reports that in addition to numerous personal data, the hackers also published content that is relevant to the security of the Federal Republic and the capital. According to the information, this concerns data from facilities that are particularly worthy of protection, such as thermal power plants, tank farms, emergency power systems and substations. The hackers are also said to have leaked secret data about prisons, waterworks and defense companies, the Bundeswehr and the Berlin interior administration that affect defense. IT expert Atug does not want to view the documents on the Darknet himself for ethical reasons. However, he explained that he learned from reputable sources that the newspaper's information was correct, at least in the case of information about civil defense and defense companies.

Federal government gets involved

So how much sensitive data was leaked? A government spokesman said the federal government was closely following the information and investigations into the data leak. The authorities involved continuously compared their information. “After analyzing potential security risks, appropriate measures will be initiated to maintain military security. According to current knowledge, federal data systems are not affected,” said the spokesman.

Jochim Selzer, spokesman for the Chaos Computer Club, said he looked at some of the leaked data. He found sensitive information about the state of the water supply in Berlin. Sorting through the huge amounts of data is very time-consuming. You can't simply search for specific terms using CTRL+F, explained Selzer.

Passports, employment contracts, application documents

The corresponding page on the Darknet is structured in three subpages. Each subpage has a file tree that you can click through, said Selzer, who is a data protection officer. He was primarily looking for personal data. He found, among other things, scanned passports without redactions, employment contracts, application documents or sick notes. How can such hacker attacks be prevented in the future? Expert Atug said: “Berlin must approve money and resources for cybersecurity and secret protection in its budget and must integrate this into long-term security processes and make it a priority.” One should worry less about surveillance and more about serious and long-term IT security, especially when it comes to state security.

“Blatant government failure”

The opposition parties in the Berlin House of Representatives made sharp accusations against the state government. Left-wing leading candidate Elif Eralp spoke of a “crass government failure by the CDU”. She called on the Senate to declare a major disaster. AfD top candidate Kristin Brinker called for a quick and comprehensive clarification. Green Party lead candidate Werner Graf criticized that there was still no plan on how to deal with the danger, protect and warn those affected and better organize security. “The week passed without any apparent precautions. This is a scandal."

SPD mayoral candidate Steffen Krach called for a massive expansion of IT security and cyber defense. FDP leading candidate Christoph Meyer called on Wegner and Spranger to resign. “In this Senate, everyone seems to be holding on to their office, while serious mistakes have no consequences.”