Overview
- The Rhysida hacker group breached Berlin senatorial systems in mid‑August and stole roughly 1.2–1.4 million files that were later published in the Darknet.
- The Berlin Senate said the acute phase of the IKT emergency ended on October 15 and has installed an interim managed detection and response service run by Deutsche Telekom using CrowdStrike’s Falcon agent for continuous alerting.
- Authorities are carrying out AI‑assisted forensic analysis to identify victims and confirm what was taken while the Landeskriminalamt, Bundeskriminalamt and the domestic intelligence service coordinate criminal and security probes.
- Published files include personal records, personnel documents and material linked to critical infrastructure, creating clear risks of identity theft, targeted fraud and potential intelligence exploitation.
- Early response contracts are already in the high six‑figure range and a conservative internal estimate puts minimum damage at around €4 million, prompting officials to push for a citywide cybersecurity architecture and other hardening measures.