Berlin: Passwords exfiltrated, 12,000 systems scanned

A large amount of data was exfiltrated, said Berlin’s Senate spokeswoman Christine Richter at a press conference following a Senate meeting on Tuesday. Passwords for some specialist applications were also exfiltrated. Richter thus confirmed for the first time what the extortionists claimed at the end of last week: In the cyberattack, which has been carried out against two Senate administrations since at least mid-August, criminals also got their hands on plaintext passwords.

This substantiates part of the ransomware gang Rhysida’s claims, which it makes with screenshots on its dark web site. According to this, password lists in plaintext were stored in Office files in the two attacked Senate administrations for Urban Development, Building, and Housing, and for Mobility, Transport, Environment, and Climate Protection. Rhysida also claims that tens of thousands of contracts from the state of Berlin, judicial documents on ongoing proceedings, and scanned identity documents were also stolen.

Cyberattack on Berlin

• August 7 to 12, 2026: In the two Senate administrations for Urban Development, Building and Housing, and for Mobility, Transport, Environment and Climate Protection, data is being exfiltrated by unknown persons. The attack began long before this date.August 14, 2026: The two Senate administrations are isolated from the state network.
• August 17, 2026: The Senate Chancellery informs via press release about an "ICT incident in the Berlin state network". An emergency crisis team is set up, the BKA and LKA are investigating, and the BSI is informed.August 21, 2026: The two authorities are still cut off from the state network. There are problems with transfer payments, including that housing benefit cannot be paid out to 50,000 eligible households in Berlin.
• August 24, 2026: All parts of the Senate administration are back online and, according to Governing Mayor Kai Wegner, are fundamentally operational.

• August 27, 2026: Florian Hauer, Berlin State Secretary for Digitization, declares: "We currently assume that the attack could be contained." He cannot rule out that personal or other non-public data are also affected.
• August 28, 2026: Security authorities meet with representatives of the state of Berlin for a crisis meeting. The attackers have stolen data and are demanding a ransom. Governing Mayor Kai Wegner declares: "The state of Berlin will not be blackmailed." There is no information on the scope and content of the data. In the evening, Der Spiegel reports that the well-known ransomware gang Rhysida is said to be behind it. On their darknet website, there is a verifiable demand for 30 Bitcoin (around 2 million euros), along with alleged excerpts from the data. The criminals promise, among other things, lists of plaintext passwords, judicial documents, and over 46,500 state contracts.
• August 30, 2026: CCC spokesman Joachim Selzer warns of possible identity theft and other fraud attempts. Citizens whose personal information may be included in the alleged data set would also easily fall victim to extortion attempts.
• September 1, 2026: At a press conference, the Senate administration confirms that passwords have also been exfiltrated. Employees of the two administrations can therefore currently not work from home. All 12,000 systems of the state of Berlin are currently being checked around the clock.

Apart from the passwords, the Senate administration declined to comment on the type and scope of the exfiltrated data when asked at the press conference. Dr. Felor Badenberg, Senator for Justice and Consumer Protection, emphasized that she could not comment on the investigation for tactical reasons. However, it was confirmed that employees of the two affected administrations are currently unable to log into the systems from their home offices. However, they can be reached by email. Further security measures are currently being taken.

Systems are being checked around the clock

This includes the fact that all 12,000 digital systems of the state of Berlin are currently being checked. It is unclear how long this will take; work is being carried out around the clock. According to the current status, the criminals only had access to the two administrations mentioned, according to the spokeswomen on Tuesday. The two main domains of these authorities have already been checked 100 percent. The cybercriminals claim to have exfiltrated 5.79 TByte of data from the systems.

They intend to publish this data on Friday if the state of Berlin does not pay 30 Bitcoin (currently around 2 million euros). The state of Berlin will not be blackmailed, said Christine Richter. She thus repeated verbatim the position of Governing Mayor Kai Wegner from Friday. If data is published, citizens and employees will be informed.

Furthermore, the Senate administration has had a short questionnaire from heise online since Saturday regarding the type of data exfiltrated, its possible authenticity, and the technical circumstances of the attack. There has been no substantive answer to this so far.

(nie)