Overview
- The breach began in early August and was publicly detected on August 14 when parts of the Berlin administrative network were isolated to stop the attack.
- On Friday the Berlin Senate confirmed it had received an extortion demand and said it would not pay, with media reporting the attackers sought about 30 bitcoin, roughly €2 million.
- Security reporters and analysts identified the leak site of the Rhysida ransomware group as the source of the public demand and of claims that roughly 5.7–6 terabytes of files were stolen.
- Forensic and criminal investigations are ongoing by the Landeskriminalamt, prosecutors, federal bodies and external specialists reported to include CrowdStrike as they verify what types of documents and personal data were taken.
- The attack disrupted services such as Wohngeld applications and payments but affected systems were reconnected this month, and officials warn the final scope of data loss and possible secondary impacts on citizens will only be clear after the forensic review.