Berlin Confirms State Network Breach, Refuses Ransom
Berlin confirmed its state administrative network was compromised in August. The city is refusing extortion demands, with attacker identity unconfirmed.
Morgan "airgap" ReyesBerlin’s state government says attackers accessed its administrative network in August and later tried to extort the state. On August 28, Berlin officials said forensic work had identified additional data exfiltration from the mobility, transport, climate, and environment department. The state says it will not pay.
The state’s August 28 announcement places the newly identified transfer between August 7 and 12, before network disconnections on August 14. Berlin said investigators were still determining the contents and scope; it could not rule out personal or other non-public information. The announcement identifies no attacker.
The Berlin data protection authority’s incident information page says stolen data was later made public and that the exposed material may include employee and citizen information. It advises people who may be affected to watch for suspicious messages and use official channels to check notices. The state’s announcement does not describe the initial access method or a technical remediation plan.
This follows a pattern of institution-level targeting this year. Qilin ransomware operators claimed responsibility for a breach at the ATF in August, which the Bureau characterized as a “major incident.” McKesson disclosed a breach this week with ShinyHunters claiming access to patient records. Colombia’s Justice Ministry was hit with ransomware in August as well.
What remains open: the complete scope and contents of the stolen data, the initial access method, and the identity of the attacker. Berlin’s ongoing investigation may change the picture as more records are reviewed.
Full details and the city’s statement via The Hacker News.
Found this useful? Share it.
