It was a story that almost went unnoticed amid all the clamor surrounding the closely watched state election in Saxony-Anhalt on September 6. This highly alarming story is one of many recent reports that have detailed attacks on infrastructure or drone attacks on airports carried out by hostile foreign powers. Incidents like this one in the German capital highlight just how vulnerable Germany's data networks are.
So what exactly happened? Since early September, employee files, official correspondence, pay stubs and even scanned ID documents have been appearing on the dark web. The hacker group Rhysida stole the data and then tried to extort the Berlin city government. They demanded a ransom of 30 bitcoins, which is equivalent to about €2 million ($2.3 million), or else they would publish the sensitive data.
But last Friday, Berlin's Governing Mayor Kai Wegner stated: "The State of Berlin will not give in to blackmail."
The data was subsequently published on the dark web, the part of the internet accessible only to tech-savvy users, where a lot of illegal activity takes place. In total, the data set consists of approximately 1.4 million records.
An employee unknowingly opened a phishing email
Two departments of the city government serving approximately four million residents have been compromised: the Department of Public Works and the Department of Transportation. This time, the attack wasn't carried out by foreign intelligence agencies, but by criminals.
The hackers initially gained access to protected data between August 7 and 14 without being detected. Rhysida, a cybercrime group believed to originate from eastern Europe, has been attacking public institutions around the world since 2023, claiming responsibility for nearly 280 attacks, primarily in the US.
The hackers were able to gain access when a Berlin Transportation Authority employee replied to a phishing email, a message disguised to appear genuine and benign. Opening one of the attachments inadvertently grants the attackers access to the victim's network.
In Berlin, the state government's secure fiber-optic network connects approximately 600 locations, ranging from municipal offices to senate departments.
Data disclosure could have serious consequences
The list of sectors that experts believe could be compromised illustrates the real gravity of the data breach. In addition to the personal data of employees and citizens, this includes information on combi-heat and power plants, fuel storage facilities, emergency power supply systems as well as prisons and water treatment plants.
In an interview with the Frankfurter Allgemeine newspaper, Jochim Selzer of the Chaos Computer Club said that the publication could have serious consequences for the people affected — even if the data only appeared on the hard-to-access dark web: "The more you know about a person, the better you can impersonate them and the better you can figure out what you need to know about them in order to, say, place an order on their behalf."
Is changing passwords enough?
And what about the political authorities responsible? The Berlin state government has instructed its employees to change their passwords. That, however, sparked outrage from Thorsten Schleheider, the vice-chairman of Berlin's police union.
He said that Berlin's data has been inadequately protected for years and that many employees have not received sufficient training: "It is unthinkable that highly sensitive data was compromised for days, and the only action taken appears to be instructing employees to change their passwords."
To address the data breach, the Berlin Senate has set up a coordination office involving all Berlin administrative agencies. It has also established contact with federal agencies such as the Federal Office for Information Security (BSI), based in Bonn.
Mayor Kai Wegner said, "We will inform, advise and support those employees and Berliners who were affected as quickly as possible."
Berlin state elections on September 20 remain safe
The Berlin authorities were, however, able to provide reassurance regarding at least one issue of concern. They announced that the September 20 election for the Berlin State Parliament is not at risk.
State Election Commissioner Stephan Bröchler told the Bild tabloid: "As things stand, all systems and processes necessary for the election remain unaffected — including election preparations, the actual election day itself and the steps leading up to the release of the preliminary results."
Chancellor Friedrich Merz (CDU) was at least indirectly affected by the data theft. The stolen information also includes details about the controversial expansion of the Chancellery in the heart of Berlin.
This article was translated from German.
