Overview
- The Berlin Senat confirmed on Friday that hackers have tried to extort the state and that the government will not pay the demanded ransom.
- A Darknet posting attributed to the Rhysida ransomware group claims roughly 30 Bitcoin and about 6 terabytes of stolen files, but investigators have not verified the group’s claims or the full contents of the leak.
- Earlier containment steps included isolating two senatorial departments from the Landesnetz on August 14, a move that left some services, including housing-benefit processing, disrupted for about a week.
- Federal and state law enforcement and external cyber specialists, including CrowdStrike, are conducting forensic scans while investigators probe how attackers first entered the network—initial findings point to a phishing e-mail clicked by an employee.
- Officials say the September 20 Abgeordnetenhaus election is protected, but they warn the forensic review is incomplete and that any confirmed loss of personal or critical-infrastructure data could widen operational and security consequences.