Loading story…
Berlin confirmed that attackers exfiltrated data from parts of its state administration between 7 and 12 August, prompting the disconnection of affected Senate administrations from the state network on 14 August. Reporting links the incident to the Rhysida ransomware ecosystem, whose suspected intrusion activity is associated with Vanilla Tempest tactics including malvertising, trojanized or fraudulently signed installers, Endico, Broomstick/Oyster and Supper malware, scheduled-task persistence, and Active Directory discovery; a claimed compromise of Stuttgart remains publicly unverified.
The incident has intensified criticism of Germany's fragmented public-sector cyber defense. The federal Interior Ministry said it will abandon a proposed constitutional amendment that would have established the Federal Office for Information Security (BSI) as a central cybersecurity authority, instead relying on existing constitutional powers, 14 federal-state cooperation agreements, NIS2-derived BSI authorities, and increased staffing and funding. Critics argue that this approach will leave state and municipal systems insufficiently coordinated against sophisticated, potentially state-directed intrusions.
TTPs, infrastructure, and targeting history in one profile.
19 events from the most recent confirmed update back to the earliest known activity.
Rhysida published approximately 1.44 million files totaling 5.8 TB on the dark web after Berlin refused its reported 30-Bitcoin ransom demand. The released material reportedly included personnel, financial, disciplinary, contract, password, and critical-infrastructure-related information.
Berlin reconnected the two affected Senate administrations to the state network after implementing additional security measures. It continued heightened monitoring and forensic investigation following the reconnection.
The network separation following the attack prevented housing-benefit payments to roughly 50,000 eligible Berlin households.
Berlin disconnected affected Senate administrations from the Berlin state network in response to the data-exfiltration incident.
Berlin confirmed that attackers exfiltrated data from parts of its state administration over the period from 7 to 12 August. Subsequent forensic work identified additional data loss.
Rhysida listed the city of Stuttgart on its leak site and demanded 5 BTC. Stuttgart said it had no evidence confirming a cyber incident, leaving the listing an unverified attacker claim.
IBM's IOC repository identified 213.232.236[.]211:80 as command-and-control infrastructure for the Supper backdoor. The observation was not evidence of a connection to the subsequently claimed Stuttgart incident.
Microsoft observed the Rhysida-associated Vanilla Tempest cluster using Fox Tempest's malware-signing-as-a-service operation, including trojanized Microsoft Teams installers distributed through advertisements and fraudulent download pages.
IBM documented a Rhysida-related intrusion chain involving a malicious, fraudulently signed Microsoft Teams installer that deployed Endico, Broomstick/Oyster, Vidar, and the Supper backdoor, with AlphaSecurity scheduled-task persistence.
An early-generation Rhysida ransomware sample, SHA-256 67a78b39e760e3460a135a7e4fa096ab6ce6b013658103890c866d9401928ba5, was first observed. The sample is a Windows PE binary that uses AES-256-CTR for file encryption and RSA-4096 OAEP to protect per-file keys and IVs.
The reported intrusion into Berlin’s state-administration network was attributed to Vice Spider, described as a Rhysida ransomware operator. The operation reportedly used the TerminalFix lure, exfiltrated data via AzCopy, and attempted ransomware encryption that was partly blocked.
Berlin's Senate Chancellery deployed CrowdStrike forensics software following the Rhysida attack and sought installation across all boroughs. Lichtenberg initially refused the agent and later accepted a limited examination, while Steglitz-Zehlendorf removed it after technical issues, prompting disputes over privacy, operational risk, and potential disconnection from specialist procedures.
Berlin's preliminary assessment stated that data leaked in the Rhysida incident included material classified “Verschlusssache – Nur für den Dienstgebrauch,” Germany's lowest official-secrecy designation. The classification indicates disclosure could cause harm if the information reaches unauthorized parties.
Federal and state security bodies, including the National Cyber Defence Centre, began evaluating the Berlin data leak. The Bundeswehr's Operative Führungskommando said it would take measures to preserve military security after assessing potential risks from potentially exposed defense-related material.
BSI said the TerminalFix ClickFix-style campaign was the initial access vector used against Berlin’s Senate administrations for Urban Development, Building and Housing and for Mobility, Transport, Environment and Climate Protection. Victims were lured through a fake Cloudflare CAPTCHA into running a malicious PowerShell command; the subsequent malware used DLL sideloading, steganographic PNG payloads, Registry persistence, and a SOCKS proxy.
In a response to Green Party deputy parliamentary leader Konstantin von Notz, the Federal Interior Ministry said the government would not submit a constitutional amendment to establish the BSI as a central cybersecurity authority. It instead cited existing federal-state cooperation arrangements, NIS2-related BSI powers, and increased BSI staffing and funding.
Attackers published a further trove of data stolen from Berlin government systems, including login credentials. Berlin confirmed the newly released material contained credentials but did not identify the affected systems or whether the credentials remained valid.
Berlin established a central contact point and public information page for residents who believe their data was illegally published following the Rhysida attack. The Senate Chancellery provided a central email address as well as administration-specific contact channels for affected individuals.
Berlin's state government established a central crisis unit to review and assess the purported Rhysida-leaked data and support notification efforts for affected citizens and businesses. The reported scope and contents of the leaked material remained unverified.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 27 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
16 references tracked. Mallory keeps watching after this page renders.
heise.de
Open sourcecyberveille.ch
Open sourceresearch.hisolutions.com
Open sourceheise.de
Open sourcesueddeutsche.de
Open sourceeuronews.com
Open sourceheise.de
Open sourcedatenschutz-berlin.de
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Berlin’s public administration detected a cyberattack on its state network in mid-August after suspected data exfiltration that investigators believe occurred between 7 and 12 August. The intrusion may have begun at least a week before discovery; Berlin temporarily isolated the Senate departments responsible for transport and for construction and housing, then reconnected all Senate departments while forensic work continued. The Berlin LKA, public prosecutors, and federal security authorities are investigating the breach. The Rhysida ransomware group has claimed responsibility and alleges it stole roughly **5.8 TB** of data, demanding **30 Bitcoin**—worth more than €2 million—and threatening to publish the material. The group claims the haul includes personal, personnel, financial, credential, legal, health, infrastructure, and potentially classified records affecting about 12,076 people, but Berlin has not verified the authenticity, sensitivity, or scope of the alleged data and says it will not pay. Officials said no election-related data has been identified as compromised ahead of the state-parliament election.
Sep 5, 2026
The Rhysida ransomware group published data stolen from two Berlin Senate administrations after the state government refused its **30 BTC** extortion demand. The group claimed to have exfiltrated **5.79 TB** of material and initially offered it for auction; the released archive appears to include active file shares and mailboxes containing personnel, legal, identity, payroll, planning, certificate, credential, and infrastructure documentation. Berlin detected data exfiltration between August 7 and 12, disconnected affected departments on August 14, restored connectivity on August 23, and confirmed the public release on September 4. Berlin has activated a central crisis unit to verify the archive, assess impacts, and notify affected citizens and businesses under German and European data-protection requirements. Officials reported no evidence that material carrying higher national-security classifications was released, but more than **1.2 million files** still require review. The exposure creates sustained risks of identity fraud, targeted phishing, credential reuse, and further intrusion; the initial access vector and any political motive remain unconfirmed, with the incident currently assessed as financially motivated extortion.
Sep 23, 2026
Berlin authorities disconnected two state ministries from the city government network after detecting a cybersecurity breach affecting the ministries for urban development, construction and housing, and for mobility, transport, climate protection and the environment. Officials isolated the ministries as a precaution while investigators examined reports that attackers may have exploited a vulnerability in one ministry’s IT systems; German media also reported that data was exfiltrated. Authorities have not publicly identified the threat actor, disclosed the intrusion timeline, or confirmed the full scope of the compromise. The incident left parts of the ministries effectively unable to work, with staff reportedly cut off from email and internet access and relying on phone, SMS, and fax for communication. The disruption also affected public services, including processing of housing benefits and education-related assistance at some district offices. Berlin’s central IT service provider, **ITDZ Berlin**, was reportedly not impacted because the affected ministries operated their portion of the state network independently, though they shared some infrastructure with each other.
Aug 27, 2026