Overview
- The Berlin Senate confirmed on Friday that the state is being extorted after a cyberattack and said it will not pay the ransom demand.
- Investigators found the intrusion was detected publicly on August 14 but data was surreptitiously copied at least between August 7 and 12, indicating attackers had earlier access to the network.
- A Darknet leak entry attributed by multiple security sources to Rhysida claims roughly 5.7–6 terabytes of files were stolen, demands 30 Bitcoin and shows a one‑week countdown while the authenticity of the samples remains unverified.
- The breach forced two senatsverwaltungen off the Landesnetz, disrupted services such as Wohngeld processing, and systems were reconnected around August 23 with some services now resuming.
- The Landeskriminalamt, the public prosecutor's office, federal agencies and private forensics firms including CrowdStrike are investigating, and officials warn sensitive or personal data cannot be ruled out and could be sold or published, raising wider questions about municipal cyber resilience.